🛡️ PR Reviews in the Age of AI: Human Guardrails Matter More Than Ever 🛡️

🛡️ PR Reviews in the Age of AI: Human Guardrails Matter More Than Ever 🛡️

Pull requests (PRs) have always been important. But with AI now generating more and more of our code, PRs have become the essential human guardrail. They’re where quality, safety, and non-functional requirements are enforced.

Over the past months, I’ve seen a range of scenarios—PRs generated by non-technical creators using AI, fully AI-generated PRs straight from tickets, and engineer-led PRs with AI-first practices (where almost every line is AI written). Each requires a different review mindset. Here are some lessons learned:

⚡ 1. PRs by non-technical creators using AI

- Assume little to no pre-commit checks or self-review. - Your job is to ensure quality and cover non-functionals (performance, security, maintainability) that the creator may not even know to check. - AI might follow code style guidelines if context is strong, but don’t count on it. - Watch PR size: if it’s too big to review properly, don’t approve. It may need to be broken down or reworked by engineering. - Give constructive feedback—they may not be aware of best practices. - Format comments for AI: prompt concise, direct, actionable. It will be copy and pasted. - Don’t repeat yourself 100 times. One well-written comment with rationale can be applied across the whole PR. - Watch out for dead/redundant/confused vibed code requiring rework.

⚡ 2. Fully AI-generated PRs from tickets

- Same principles apply as above: small, single-purpose PRs are manageable. 100+ file changes are not. - Remember: feedback goes directly into AI and taken as gospel. Don’t hedge with “maybe” or “could.” Be clear and specific on what you want done. - You can also prompt AI yourself: for example, ask it to validate functional usage or test cases.

⚡ 3. Engineer-led, AI-first PRs

- These PRs will often have stronger structure because an engineer guided the prompts and reviewed as they went. - Expect minimal manual typing; AI wrote most of it. - The extra value here is helping the engineer use AI better for the next PR as well as the usual PR checklist. - Don’t expect manual edits—too slow. Instead, give comments that can be copy-pasted into AI to refactor or fix.

🚫 What not to do

- Don’t “AI wash” a review. Dumping a giant AI-generated review misses the point. PR reviews are a human gate. - Do use AI as a second opinion: copy small code sections, ask for alternatives, or spot potential issues. Then summarize in your own judgment.

✅ The new rules of AI-era PR reviews:

- Tailor your review style to the type of PR and who’s behind it. - Write feedback as prompts, not essays. - Remember: the comments you write will often be used verbatim in AI. - Stay human: judgment, context, and non-functionals are still our job.

✨ In the AI era, PRs aren’t just about catching issues. They’re where we make sure AI-accelerated development still meets engineering standards. They are the place where humans remain firmly at the helm.