The Short Leash AI Coding Method For Beating Fable
blog.okturtles.org ● Covered by 6 sources
A security-focused dev shop explains how it uses AI coding agents without letting quality slip: never full autopilot, always review diffs.
Based on reporting by blog.okturtles.org — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
There's a version of AI-assisted coding that looks great on YouTube and terrible in production. Someone sets up a dozen parallel agents, walks away, sips coffee, and comes back to a pile of code that technically runs. The team behind okTurtles, a group that maintains security-critical software, spent over a year testing that approach and others before landing on something they call the Short Leash Method — a deliberately hands-on alternative to the 'vibe coding' trend.
The core complaint isn't that AI writes bad code exactly. It's that AI writes code that works but is inefficient, ugly, or subtly wrong in ways that only surface once someone actually tries to use the thing. That problem gets worse in niche domains without much training data, since models can't reason past what they've seen — no matter what any CEO claims about emergent thinking. So instead of granting agents 'YOLO mode' or dangerously-skip-permissions access, the Short Leash Method keeps a human developer parked in front of every diff, approving or denying changes one at a time, committing after each subtask so a rogue agent (they've seen Opus do this) can't wipe out prior work.
The method starts with a planning phase — research the task, break it into steps, track progress — before any code gets written. From there it's a constant loop of proposal and review: the agent suggests a change, the human reads the diff, and either approves it or shuts it down before it goes sideways. That loop, according to okTurtles, doubles as a way for the developer to keep their mental model of the codebase current, rather than losing track of what the AI actually did.
Review gets a second layer too. Every pull request should get read by both a human and an AI, since the AI acts like a sharp linter catching small mistakes while the human handles the bigger architectural calls. okTurtles wants PR descriptions to disclose exactly which models were used, partly for transparency and partly so maintainers can suggest a better model if a weak one produced sloppy work. And critically, if a developer used AI to help write a PR, they're expected to review their own PR line by line before asking anyone else to look at it — treating it the way they'd treat a stranger's code, because ultimately it's their name on it.
None of this is pitched as a beginner's workflow. okTurtles is explicit that it's meant for developers who already know more than the models they're supervising, using AI as a force multiplier rather than a replacement for judgment they haven't built yet.
My take — AI-written commentary, not fact-checked reporting
This is basically the boring, correct answer buried under a year of hype about autonomous agent swarms, and I respect that okTurtles is willing to say the emperor's parallel-orchestrator has no clothes. The uncomfortable part is that this method only works if you're already skilled enough to catch the AI's mistakes in real time — which means the junior devs who most need supervision are the ones least equipped to supervise anything, and nobody's solved that gap yet.
Read more about this at: blog.okturtles.org