Code quality in the age of AI needs verification, not hope

At a glance

What this is: Sonar argues that AI-written code turns software quality into a verification problem, because scale and speed now expose flaws that manual review alone cannot reliably catch.

Why it matters: For IAM and security teams, the lesson is that code-producing agents and AI-assisted pipelines need deterministic quality gates, not trust in downstream human inspection.

Context

Code quality is the degree to which software is correct, maintainable, secure, and reliable over time. In AI-assisted development, the core governance problem is that code can now arrive faster than people can meaningfully inspect it, which changes verification from a documentation exercise into a control problem.

That matters to identity and security programmes because software pipelines increasingly behave like machine-driven production systems with their own privileges, dependencies, and release paths. When AI-generated changes are accepted without deterministic checks, architectural drift and hidden defects can enter the codebase faster than peer review can absorb them.

Key questions

Q: How should teams verify AI-generated integration, build, and infrastructure code before it reaches production?

A: Teams should apply the same independent analysis to AI-generated code that they use for hand-written code, especially in integration flows, build scripts, and infrastructure automation. The goal is to catch bugs, vulnerabilities, and maintainability issues before merge. Deterministic verification matters because a language model cannot reliably validate its own output, and silent defects in these layers can cascade quickly into production incidents.

Q: Why does AI-generated code increase code review risk for senior engineers?

A: AI changes the shape of review work. It produces more code faster, but review quality depends on deeper judgement than writing code, and rare mistakes are easy to miss when they appear infrequently. That combination creates fatigue, zones reviewers out, and pushes teams toward shallow approvals unless they deliberately protect review capacity and enforce strict oversight.

Q: What are the signs that AI-assisted development is failing in a mature codebase?

A: Common signs include incorrect assumptions, overly verbose prompting, repeated rule errors, and code that misses required config or registration steps. Another warning is when the AI produces output that looks complete but does not reflect current task requirements or established patterns. In practice, teams should treat these as signals to tighten rules, improve context, or revalidate the workflow.

Q: Should organisations prioritise automated verification over manual code review?

A: They should use both, but not for the same purpose. Manual review is better for intent, design, and business logic, while automated verification is better for scale, consistency, and rule enforcement. In AI-assisted development, the balance shifts toward automation because human review cannot reliably inspect every generated line before merge.

Technical breakdown

Why AI-written code breaks manual review assumptions

Traditional code review assumes a human can read the change set, understand the intent, and spot defects before merge. AI-generated code weakens that model because the payloads can be large, asynchronous, and syntactically plausible even when they contain hallucinated packages, insecure logic, or inconsistent patterns. The problem is not only volume. It is that review becomes probabilistic when the reviewer is forced to sample rather than verify every meaningful path. Static analysis and test gates become necessary because they evaluate the code itself, not the reviewer’s confidence.

Practical implication: Treat human review as intent validation and require automated verification to enforce standards before merge.

Deterministic quality gates in the agent centric development cycle

A deterministic quality gate is a control that produces repeatable pass or fail outcomes against defined standards, rather than a subjective assessment. In an AI-assisted workflow, that means checks for syntax, dependency validity, security defects, and architectural conformance must run in the pipeline and, where possible, during generation. The article’s model is effectively a closed loop: guide the agent, inspect the output, correct the defects, and then re-run the checks. That matters because quality can no longer depend on a single human reviewer seeing everything at once.

Practical implication: Move verification left into the CI/CD flow and make failed checks block promotion automatically.

Code quality now includes security, auditability, and maintainability

The article ties code quality to more than readability. It includes security, scalability, reliability, and audit readiness, which means poor-quality code becomes a governance issue as well as an engineering one. This is especially relevant where software must support regulated or safety-sensitive workflows, because inconsistent patterns and poor traceability make later assurance harder. In practice, code quality metrics such as complexity, coverage, and technical debt only matter when they are connected to decision thresholds, not treated as vanity dashboards.

Practical implication: Define quality thresholds that link engineering metrics to release approval and audit evidence.

Threat narrative

Attacker objective: The practical objective is to get flawed or insecure code accepted into the software supply path before reliable verification can stop it.

1. Entry occurs when AI-generated code enters the development workflow as large, fast-moving payloads that humans cannot fully inspect.
2. Credential or dependency abuse appears when the code includes hallucinated packages, insecure patterns, or hidden flaws that bypass informal review.
3. Impact follows when defective code is merged, creating technical debt, security exposure, and unreliable behaviour in production systems.

Breaches seen in the wild

• Firebase misconfiguration exposure 2024: Missing Firebase security rules on 916 websites exposed 125 million user records and 19.87 million plaintext passwords; a quarter were fixed.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Verification debt is now a first-order engineering risk: when code is generated faster than people can inspect it, the organisation accumulates unresolved trust in what the pipeline produces. Manual review was always a sampling control, but AI-assisted development turns that limitation into a governance gap. The right question is no longer whether reviewers are diligent enough, but whether the workflow can verify outputs at machine speed. Practitioners should treat code verification as a control design problem, not a productivity preference.

AI-written code creates a new form of quality debt: the issue is not simply more defects, but defects that arrive with enough volume and coherence to look plausible. That undermines the old assumption that human reviewers will reliably catch the important errors before merge. In identity and security programmes, the same pattern appears whenever a system can create or modify technical artefacts faster than governance can attest them. Teams need controls that prove code meets standards before release, not confidence after the fact.

Quality gates have become part of the security boundary: static analysis, test automation, and dependency validation are no longer optional hygiene steps. They are the mechanism that stops hallucinated packages, inconsistent architecture, and hidden security flaws from becoming production risk. The broader lesson is that control effectiveness now depends on deterministic enforcement inside the development pipeline. Practitioners should align code-quality policy with release control, because verification is now part of security assurance.

AI-assisted development shifts the developer role from author to orchestrator: the article’s strongest implication is organisational, not just technical. If agents are generating more of the code, then governance has to move to standards, guardrails, and exception handling rather than line-by-line editing. That changes how teams measure control effectiveness and technical debt across delivery pipelines. Practitioners should redesign oversight around verified outputs, not manual craftsmanship.

Code quality in the age of AI is really control quality: the named concept here is the verification gap between generated code volume and human inspection capacity. That gap will widen as teams rely on asynchronous generation across more parts of the SDLC. The organisations that adapt will define quality as a repeatable control outcome and not as an after-the-fact review outcome. Practitioners should make quality gates the primary assurance mechanism for AI-assisted code.

What this signals

AI-written code turns quality control into a governance problem: teams need to verify generated output against explicit standards before the merge step, because downstream inspection cannot keep pace with machine-generated volume. That shifts assurance from reviewer judgement to pipeline enforcement, which is the only control model that scales.

Quality gates must now carry security and audit weight: once AI agents or assistants produce code at speed, organisations should assume that defects can be introduced faster than traditional review can absorb them. Practitioners should anchor release policy in measurable controls such as automated analysis, test coverage, and complexity thresholds.

For practitioners

• Implement deterministic pre-merge verification Require static analysis, dependency checks, and test execution to pass before AI-generated code can merge to protected branches.
• Separate intent review from standards enforcement Use human reviewers to validate design intent and business logic, then use automated controls to enforce coding standards, security rules, and architectural patterns.
• Set release thresholds for complexity and debt Define acceptable limits for cyclomatic complexity, cognitive complexity, coverage, and technical debt ratio, then block promotion when the thresholds are exceeded.
• Validate generated dependencies before build promotion Scan for hallucinated or unapproved packages in AI-written changes so dependency drift does not enter the build chain unnoticed.

Key takeaways

• AI-assisted development changes code quality from a readability issue into a verification issue because generated output can outpace human inspection.
• Deterministic gates matter more than reviewer confidence when code arrives in large asynchronous payloads and can contain plausible but flawed logic.
• Teams should separate intent review from standards enforcement so that humans judge design while automation blocks insecure or unverified code.

Key terms

• Code Quality Check: A code quality check evaluates how maintainable and readable code is over time. It focuses on structural issues such as complexity, duplication, dead code, and naming, helping teams identify where future changes are likely to become slower, riskier, and more expensive.
• Technical debt: Legacy shortcuts or weak design choices that create future cost, risk, or operational friction. In identity programmes, technical debt often shows up as brittle trust relationships, inconsistent revocation, poor traceability, or controls that only work in one environment and fail in another.
• Static analysis: Static analysis is the inspection of source code or configuration without executing it. It helps identify insecure patterns early, but its value depends on accuracy, timing, and whether the output is usable enough for developers to fix issues while they are still working on the code.
• Deterministic Verification: A verification method that produces the same enforced result every time when the required proof is present, instead of relying on human judgement or probabilistic signals. It is useful for high-blast-radius access changes because it removes discretion from the decision point.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management alongside the controls that support broader identity programmes. For security and engineering practitioners, it gives a common language for governing access, automation, and trust across modern delivery pipelines.