How to review AI-generated code

Review AI-generated code by reading the diff and a short receipt, then deciding the merge yourself. The receipt says what changed, what was inspected, what could not be proved, and what a person still owns. The agent may inspect and explain. It does not approve the change.

We teach this as the Review step in our methodology. Delegate a small task, require evidence, and keep the merge with the team. The same rule covers Claude Code, Cursor and Codex.

Ask for a receipt before you read the chat

A review receipt is a short record on the pull request. It should name the files, the checks that ran, the risks that remain, and the decision a person still has to make. A confident paragraph with no file path and no test result is not enough to merge.

Start with the diff, not the chat. The code has to stand on its own. Then use the receipt to see whether the risky parts were actually checked, especially when the agent can call external tools.

The longer version of this pattern is AI code review with receipts.

Keep the task small enough to review

Give the agent work with a clear before and after. A missing test, a small validation change, or one helper extracted without a behaviour change is a fair first task. A vague request to improve a whole area produces a diff nobody can review in one sitting.

Write the boundary before the run: which files, which commands, and which external tools are allowed. If the diff leaves that boundary, send it back.

What the person still owns

The person who approves the change owns requirements fit, design, and the verification of each finding. Automated comments can point at a line. They do not replace that decision.

Use the same bar for every tool. A review comment from Codex, a Cursor agent, or Claude Code should be traceable to files, tests, and the repository rules.

Teams that want this as a shared habit can start with training on their own repository, or with services when they want a workshop plus a regular briefing. Book a 30-minute call if you want to plan that with us.

Frequently asked questions

What should an AI code review record?

A short receipt of what changed, what the review inspected, what it could not prove, and what a person still owns before merge.

Can an agent approve its own change?

No. The agent may inspect and explain. The team still owns the merge decision.

Where does this sit in the method?

It is the Review step of Delegate, Review, Own. The agent works inside a boundary, and a person checks the evidence.