Human Review vs. Verified Pipelines: Where Does Your Team Stand?
During the session, John and Viktor talked about why code review is struggling to keep pace with AI-generated code, and what it looks like to verify every deployment against defined rules instead, regardless of who or what wrote the code.
If you want the fuller argument, John's post Code Review Is Theater Now lays out the data behind it. Pick the option below that sounds most like your team, and get a short, honest read on what's likely slipping through, plus resources to help close that gap.
One caveat worth keeping in mind: this isn't "review is dead." Review still earns its keep for knowledge-sharing and catching design-level issues, especially for engineers still building judgment. The question is whether it's still doing the job it used to.
A human reviews every PR
If a human reviews every pull request
Even where review is happening, it's often not scaling with volume. Faros AI's 2026 telemetry found median PR review time up over 400% under high AI adoption. Meanwhile, 31.3% more PRs are now merging with zero review at all, because reviewer capacity simply ran out.
Ask yourself
How has your PR volume changed in the last year? If something shipped tonight, is there a defined rule it would have to pass, or does it just need a person to say yes?
The gap worth closing
Add a defined, automated check that runs regardless of who approves, so rising volume doesn't quietly erode what "reviewed" actually means.
Resources
AI helps review, human signs off
If AI helps review, but a human signs off
AI reviewing AI-generated code shares the same training data and blind spots as the code it's checking. CodeRabbit's analysis found AI-generated code carries roughly 1.7x more issues than human-written code, with security vulnerabilities up 1.5 to 2x. GitLab's 2026 AI Accountability Report found 43% of organizations can't reliably tell which code in their own codebase was AI-generated.
Ask yourself
When your AI reviewer flags something, does a human actually dig in, or does the flag just become the new "looks good to me"?
The gap worth closing
Judgment-based review, human or AI, needs a deterministic backstop: rules that check specific things every time, not another layer of opinion.
Resources
We run automated checks and ship
If you run automated checks and ship
The question is what those checks actually cover. Code-level tests and linting catch a narrow slice of risk. They typically don't cover deployment-level rules like environment policy, required approvals, or rollback conditions.
Ask yourself
If your last production incident happened again tomorrow, would your current checks have stopped it, or would only a human have caught it?
The gap worth closing
Extend verification past code tests into deployment policy, so every release is checked against defined rules regardless of who or what wrote the code.
Resources
It's a mix, depending on the team or repo
If it's a mix, depending on the team
Inconsistency is itself the risk. Cortex's 2026 benchmark found most organizations still lack a formal, enforced AI governance policy. Octopus's own Compliance Ratchet post warns that once a rule gets added after an incident, it rarely gets removed, even after old habits return.
Ask yourself
Could you say, right now, which of your repos has the least verification behind it?
The gap worth closing
One baseline set of rules that applies regardless of team or repo, so inconsistency stops being the thing nobody owns.