kengdevLet’s talk
Updated on 2026-09-10
AI-assisted code review has a model read every diff and post comments before a person approves. The AI merges nothing: it cuts the time spent spotting mechanical problems and leaves the merge decision to a human.
Shorten review time without turning approval into a formality nobody reads.
A tool that comments on everything ends up ignored. Tune it to say less, and better.
AI comments, humans approve
Code review remains a quality pillar, but it has its costs: time, variance from one reviewer to the next, and queues that block delivery. AI review aims at a fast, more consistent first pass.
In practice, the bot looks at the diff and the lines around it, the style, suspicious patterns, sometimes global team rules. It posts its comments on the MR or PR. It does not merge.
The observed upsides and limits fit in two columns:
| AI review brings | It still misses |
|---|---|
| Fast first feedback | The acceptance criteria of a user story |
| Coverage when reviewers are saturated | Subtle business intent |
| Consistent feedback on cross-cutting rules | Rare races and product design |
Without the user-story context, the bot stays on global rules anyway.
Risk: inverted review fatigue
If everything is "AI-approved", nobody really reads the code anymore. It is the same trap as poorly calibrated HITL.
The countermeasure fits in three rules: the bot stays in comments only; auth, payments, migrations and PII always go through senior review; and a short human checklist remains mandatory.
More commits does not mean more value. We look at post-merge incidents and the time it takes to understand a module.
What AI detects well (and poorly)
The bot is good at everything that shows directly in the diff:
- Obvious style issues
- Missing null checks
- Deprecated APIs
- Missing happy-path tests
- Simple hardcoded secrets
It is weak at whatever requires context: business intent, rare edge cases, cross-cutting architectural debt, or sarcasm in the specs.
Judge the signal-to-noise ratio after two sprints of calibration, not on a single false positive. And if more than 30% of a rule's comments get ignored, cut the rule.
Setup in 2 sprints
The rollout fits in two sprints:
- Sprint 1: install the bot on a non-critical repo, measure noise against real catches, set a 5-item human checklist and train the team in 45 minutes.
- Sprint 2: extend to the main repos. Merge blocking only applies to deterministic rules (secrets, lint), never to a fuzzy LLM opinion alone.
Integrate everything with your existing CI, GitHub or GitLab. And if the diff leaves your perimeter, check code confidentiality: DPA, enterprise mode or self-host.
If you want to set up AI review and the conventions that go with it, we can scope the approach in 20-40 minutes.
Frequently asked questions
Does AI review replace seniors?
No. It removes nitpicks and frees time for architecture and risk. Seniors remain the decision-makers on critical paths.
Block merge on LLM opinion?
It is not advisable at first. Block the merge on deterministic rules (secrets, lint), not on a model's opinion.
GitLab Duo / Copilot review?
They are ecosystem options. Evaluate integration, confidentiality and noise: team policy outranks the tool's brand.
Sensitive proprietary code?
First check whether the code leaves your perimeter. Prefer enterprise options, self-hosting, or clearly written retention.
Link to vibe coding?
Vibe coding without review is the worst case. AI review helps the first pass, but it does not replace understanding the diff.
Sources and references
- Best practices for Claude CodeAnthropic
Primary documentation for product capabilities and changes.
