Human PR Review Is Next

A new argument is taking shape in programming circles: if AI can write the code, maybe humans shouldn’t be the ones reading every line of it anymore. The old stance was that AI output was buggy slop. Then the line changed to: sure, use it to write, but never to review. The next shift, the author argues, is already starting — and it’s pushing review out of the diff and into the rules around the code.

That’s a big change in how the job works. Line-by-line review used to be the safety net. Now the safety net is supposed to be tests, guardrails, monitoring, and multiple review passes from models that are not the author. The author says they now start from a hard constraint: they do not read the implementation line by line, even though they used to think that was the responsible thing to do.

Instead, the work moves earlier and later. Before code exists, guardrails catch predictable AI failure modes like duplication, drift, too much complexity, bad tests, sketchy dependencies, memory grabs, and weak security boundaries. Review agents — including tools like Copilot, Cursor’s Bugbot, and CodeRabbit — check pull requests. The author also describes a multi-model setup where one model sees only the diff, one sees the whole repo, and one sees only the spec. After that comes UAT: user stories, end-to-end checks, and direct testing of what the software does.

The cost of this approach is that more bugs get through, at least at first. That includes serious ones, and the author doesn’t pretend otherwise. But some bugs are easier to live with than others. A slow endpoint can be rolled back. A leaked key, deleted data, or a bad migration can’t. So the emphasis shifts to what can’t be undone: secret scanning, fast-expiring keys, dependency checks, CI permissions, kill switches, least privilege, immutable logs, and separate environments.

The author uses a small Kalshi trading bot as proof of concept. It has about $127 of their own money in it, sits around $158 right now, and has placed about 1,500 trades in almost three weeks. It also lost money on a requirements bug: prices were rounded to whole cents before the buy check, so 95.5 counted as 96 and slipped through. The author caught it by having the agent audit its own trades, then fixed it. The point isn’t that bugs disappeared. It’s that the owner now has to judge the system by its requirements, its guardrails, and its operating limits — not by reading every line.

AI review is inevitable because AI coding already is. The industry just likes pretending the last human left in the loop is a sacred safeguard instead of a bottleneck with a keyboard. The real premium now is on people who can write the rules, set the traps, and own the mess when the model ships something dumb.