Review AI-generated code with a concrete checklist

Generated code can be syntactically clean while missing timeouts, validation and failure handling. Treat it as an untrusted contribution that requires the same review as other code.

Find concrete defects

The engineering foundations lab reviews a two-line fixture.

from engineering_cases import ai_review_case

result = ai_review_case()
assert result["findings"] == [
    "no timeout", "no status handling", "no response validation", "no tests"
]
assert result["approved"] is False
assert result["ai_tool_called"] is False

Start from intended behaviour and trust boundaries. Trace happy and failure paths; validate inputs/outputs, identity, authorization, secrets and injection risks. Check timeouts, retries, idempotency, resource bounds and logging. Verify APIs and dependency versions in primary documentation and review license/provenance.

Run types, tests, linters and security scans appropriate to the change. Add a failing test before repair where practical. Understand every line you accept and keep the prompt/output out of logs if it contains protected code or data.

The FDE for Freshers course teaches AI copilots with validation discipline rather than blind shipping.

Exercise

Review a generated API adapter using the checklist, plant two bugs and show the tests catch them before acceptance.

Continue learning

This article is part of the FDE engineering foundations sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Refactor a notebook into a tested service.
• Continue with Create a reproducible developer setup guide.

Reference: NIST Secure Software Development Framework.