Originally posted on LinkedIn.
There's a lot of handwringing about merging code that has only been reviewed by AI. It's backwards. A process where some code is reviewed only by AI will be more security conscious than what we do today.
Start with the problem. AI writes more code than any team can review, so everything gets the same rushed skim, and the changes that actually matter don't get the attention they deserve. The fix isn't more reviewers or going slower. Teams can’t afford to ship slower in this environment. It's deciding what humans need to see at all.
Humans were always bad at this part anyway. Outside the most egregious cases, we've never been good at spotting a bug or a vulnerability by reading code cold. AI has been better at that for a long time. A half-distracted developer waving through a diff is not your security baseline. An agent making that call catches more.
So route deliberately. Certain file paths and high-risk changes go to humans. That's a mix of deterministic rules and AI classification, and classification is something AI is good at. Everything else is reviewed by AI alone. Now the sensitive code gets real scrutiny instead of competing for attention with everything else.
What was human review ever really verifying? Legibility. Could another person read this and follow it. But the primary reader is shifting from human to AI, so stop optimizing for human legibility and start optimizing for AI legibility. We used to have complexity metrics for how hard code was for a person to parse. I want the equivalent for a model, scoring not just structure but whether the prompts, skills, and agents around the code help it understand what it's looking at. That's the thing worth building.