How I keep full control of AI-written code

Last week I wrote about letting AI build a side project with more than 100k lines of code. It took six hours. The project had an API, mobile apps, an admin panel, and a marketing site. Every part of it ran, which looked impressive at first.

Then I tested it. Almost every screen and API endpoint had a bug, a UI problem, or some strange decision I did not ask for. I knew what I had written in the plan, but the code itself felt like somebody else’s project. Reading all of it will take much longer than creating it did.

I still use AI every day, and it does almost all the hands-on work for me. I usually review, comment, accept changes, and handle permission requests. The test changed how I control that work.

Large tasks leave too much space for guessing

AI has to fill every gap in a plan. Sometimes it makes a good choice. Sometimes it adds another authentication method, writes code that could be replaced by a library, or builds a feature in a way I would never accept during a normal review.

I probably caused some of those problems by leaving details out. Either way, I am left with code that is hard to maintain. Once AI writes 100k lines, finding every wrong assumption becomes my job.

With a static website, I can open its pages in a browser and check the text and layout. I may not care much about the generated code if the site works.

I cannot review a product with user data in the same way. An API, database, authentication, and mobile apps can hide security or logic bugs that I will never find by clicking around for ten minutes.

I do not think developers are finished

I keep seeing stories about AI building whole companies, writing every line of code, and making developers unnecessary. Maybe some people can make that work, but for now it looks more like marketing and clickbait to me.

Teams can become smaller. One good technical developer working with several AI agents can already do more than an entire team could do before. The developer may write much less code, but someone still needs to understand the product, keep control of the work, and make the final decisions.

AI can do almost everything I ask. It cannot take responsibility when the product has security problems, loses user data, or simply fails. At least for now, that responsibility still belongs to a person who understands what AI created.

My current workflow

I start by describing what I want and writing the first version of the plan. Several AI models expand it, point out missing details, and suggest changes. AI then turns the finished plan into small tickets. I review the plan and tickets before any coding starts, and AI fixes anything that does not match what I want.

One model works on a ticket, creates a branch, and opens a pull request. Then one or two other models review the changes. Their comments go back to the first model, which fixes the useful ones. If an agent needs access to a tool, service, or protected action, I decide whether to give it permission.

Then it is my turn.

I read the diff, test the feature, and leave my comments. AI answers my questions and makes more changes when something looks wrong. Even when all the models agree, I leave the pull request open if the solution looks too complex, and I work through the code until I understand it.

Several tickets can move through this process at the same time. One agent can write code while another reviews a different pull request, so I am rarely waiting for them. AI handles the implementation, tests, branches, pull requests, fixes, and most reviews. I spend my time checking its work and making decisions.

Why I keep the tickets small

When one ticket changes a small part of the project, I can spot work outside its scope or a solution I do not like. Bloated code stands out too, before the same idea spreads into other files.

With a large change, I lose that view. Hundreds of files may look correct during a quick review, and the project may even pass its tests, but I still have no idea what decisions are buried inside it.

My custom rules and reviews from other models catch some mistakes before the code reaches me. I still review every pull request myself, leave comments, and decide what gets merged. Before merging, I read the diff once more.

AI does most of the work. I keep control of the project, choose what gets built, approve permissions, reject changes I do not want, and make the final merge decision. The product is mine, and its success is my responsibility.