AI Writes the Code. Verification Is Now the Real Work

An AI coding agent can draft a working feature in minutes. The harder question comes straight after: how do you know it is correct?

Sonar’s State of Code developer survey, based on 1,149 respondents, puts numbers on that gap. According to Sonar’s summary, 72% of developers who have tried AI coding tools now use them every day, 96% do not fully trust that AI-generated code is functionally correct, and only 48% say they always check it before committing. Sonar sells code quality tools, so read this as one vendor’s signal rather than a law of nature. It still matches what many teams feel: generating code got cheap, and being sure about it did not.

Why faster code does not mean faster delivery

Typing was never the only constraint. Code still has to be understood, reviewed, tested, deployed and maintained. When an agent produces more of it, the queue simply moves to review.

Sonar describes this as “a new verification bottleneck”, and reports that developers still spend about 24% of their week on toil, with part of that burden now going to correcting unreliable AI output. Generated code is also easy to approve by accident. It compiles, it reads well, and it may pass the tests the same agent wrote, while quietly missing what the business actually asked for.

Give the agent a written brief

An agent only knows what it can see. A short instructions file in the repository saves the same corrections from being repeated in every session. AGENTS.md is one open format for this, and it is among the founding projects of the Agentic AI Foundation at the Linux Foundation.

# AGENTS.md
## Commands
- Install: npm ci
- Test: npm test
- Lint: npm run lint

## Rules
- Change only the files this task needs.
- Every bug fix starts with a failing test.
- Do not add a dependency without asking.
- Never read or print the contents of .env files.

Keep each change small enough to review

A reviewer can reason about a focused change. Nobody can properly review a large one that mixes a feature, a refactor and a new library. Three habits help:

Give each task its own branch and pull request.
Ask the agent for a plan first, and correct the plan before any code exists.
Send back changes that wander outside the task, even if the extra work looks good.

Write the test before the feature

Tests written in the same session as the code tend to share its misunderstandings. If a person writes the acceptance test first, or at least reviews it before the implementation starts, the agent has a precise target that it did not choose for itself.

test('a cancelled order cannot be invoiced', async () => {
  const order = await createOrder({ status: 'cancelled' });

  await expect(invoice.post(order.id)).rejects.toThrow(OrderCancelled);
});

Let the pipeline be the strict reviewer

Automated checks do not get tired, and they treat human and generated code the same way. Run them on every pull request, and make them block the merge.

name: verify
on: pull_request

jobs:
  verify:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm ci
      - run: npm run lint
      - run: npm run typecheck
      - run: npm test -- --coverage
      - run: npm audit --audit-level=high

What a person should still check

Pipelines catch what can be stated as a rule. Reviewers are there for everything else:

The request. Does this solve the problem that was actually asked about?
The risky paths. Permissions, payments, deleted data and database migrations deserve a slow read.
New dependencies. Does each package exist, is it maintained, and is it really needed?
Failure. What happens when the network, the database or the input is bad?
Ownership. Could you explain this code and fix it during an outage?

A simple rule for the team

Whoever merges a change owns it, whether they typed it or not. Measure the results that follow from that rule, such as review time, reverted changes and bugs found after release, rather than the number of lines generated. If those numbers improve, the agents are helping. If only the line count improves, you have moved the work rather than reduced it.

Planning to bring AI into your products or your development process? See how we build AI agents, or talk to our team.