Topic starter
12/06/2026 9:20 pm
TL;DR: As AI-generated code and agent-assisted development speed up change, the codebase is becoming less reliable as the source of truth and observability has to close the gap, according to WorkOS's interview with Honeycomb CEO Christine Yen. The governance challenge is no longer just debugging faster software, but proving what software actually did when humans and agents both shape production behaviour.
Editorial analysis by NHI Mgmt Group, based on content published by WorkOS: “Software still does things we don't expect”.
Key questions
Q: How should teams govern AI-generated code when they cannot review every change?
A: Teams should shift from source-only assurance to runtime assurance.
Q: Why do evals not replace observability for AI-shaped systems?
A: Evals only test anticipated behaviour under controlled conditions, while observability shows what happens when real users, edge cases, and production dependencies appear.
Q: What are the signs that code review is no longer enough for production assurance?
A: The main signs are rapid code growth, frequent AI-assisted changes, and repeated production surprises that cannot be explained by reading the code alone.
Practitioner guidance
- Define runtime evidence requirements Specify which traces, logs, and request attributes are required to explain production behaviour when code review cannot fully reconstruct intent.
- Separate eval coverage from observability coverage Map which behaviours are tested before release and which signals must remain visible in production when real users create unanticipated paths.
- Tie quality metrics to business impact Document the user or service outcomes that matter enough to trigger investigation, so observability focuses on meaningful deviation rather than raw system noise.
Bottom line: AI-generated code reduces the reliability of source code as the primary explanation for production behaviour.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 5 days ago by NHI Mgmt Group
12/06/2026 11:20 pm
AI-generated code makes observability part of governance, not merely operations. When code is created and changed faster than humans can fully inspect it, the codebase no longer functions as the authoritative account of system behaviour. The operational record shifts to telemetry, traces, and runtime evidence. That creates a governance obligation to decide which observed behaviours are acceptable, explainable, and attributable.
A few things that frame the scale:
- 70% of organisations grant AI systems more access than they would give a human employee performing the exact same job, according to the 2026 Infrastructure Identity Survey.
- Systems with least-privileged AI access had a 17% incident rate vs 76% for over-privileged systems. Organisations failing to scope AI access properly are 4.5x more likely to experience a security incident, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: How should organisations define observability for non-deterministic systems?
A: They should define observability around business-critical outcomes, not just technical success indicators. If a user-facing or revenue-relevant condition can be harmed without a traditional error, that condition needs to be encoded into monitoring, alerting, and investigation criteria.
👉 Read our full editorial: AI code generation is making observability a governance issue
This post was modified 5 days ago by NHI Mgmt Group