I've learned the hard way that there is a massive gap between "this produces the screen I asked for" and "this is actual engineering." AI is a master of the demo; it's significantly worse at respecting your app's systemic boundaries.
If you're using AI for your AI workflow, here is the "don't get fired" checklist for reviewing changes.
The "User Contract" Filter #
Before you even look at the diff, write down exactly what the feature is supposed to do in one sentence.
Example: "A signed-in user can save a private note and see only their own saved notes after refreshing."
If you just tell the AI "add notes," you're asking for trouble. Once you have your contract, force the AI to point to the exact lines where ownership is enforced and where the data persists. If it starts rambling instead of giving you line numbers, the code is a gamble.
## The 5-Point Post-Mortem Checklist
The Data Path: Trace the data from the input field to the DB and back. AI loves to update a form and a query in two different ways, leaving the bridge between them broken. Is the data normalized? Is it actually from the source, or is it just hallucinating a local state?Authorization (The "Hidden Button" Fallacy): Hiding a button in the UI is not security. Check the server-side authorization. If User A can change an ID in a request and suddenly see User B's private data, your "feature" is actually a security breach.The "Happy Path" Bias: AI is an optimist; it assumes the network never fails and users never type nonsense. Check the failure paths. What happens during a timeout? Does a failed save trigger a success toast? If the state doesn't clear on an error, your UI is now a brick.The Change Surface: Make the AI list every single file, schema, and environment variable it touched. This is how you catch the "silent killer"—when a tiny feature request quietly rewrites a shared utility function and breaks three other unrelated pages.State Persistence: Ensure the AI isn't just mirroring data in the frontend state to make the demo look fast while the backend is actually returning a 404.
Basically, treat the AI like a junior dev who is incredibly confident but occasionally lies about whether they actually tested the code. Trust, but verify everything.
Next Fixing Author-Trust 0 and Noindex Issues →