Notifications
Clear all
Topic starter
14/09/2026 10:10 am
TL;DR: AI coding tools increase throughput only when teams engineer the loop around them, according to Sonar’s podcast with Ian Johnson, who says disciplined inputs, standards, and layered verification matter more as generation becomes cheap. The real control problem is not speed, but preventing cognitive surrender and comprehension debt from turning agent output into unreviewed risk.
NHIMG editorial — based on content published by Sonar: The Next Commit podcast discussion with Ian Johnson
By the numbers:
- Participants followed AI advice 79.8% of the time even when it was wrong in the cited behavioural study.
- Code quality issues rose 30% and complexity rose 41% after the initial AI adoption spike.
Questions worth separating out
Q: How should security teams govern AI-generated code in production environments?
A: Security teams should treat AI-generated code as normal production code with extra provenance risk.
Q: When does AI-assisted development create more risk than it reduces?
A: It becomes net risk when code volume grows faster than ownership, review, and fix capacity.
Q: What are the warning signs that AI code review is failing?
A: Look for large pull requests approved with minimal discussion, reviewers unable to explain the change, repeated exceptions to standards, and security checks treated as ceremonial.
Practitioner guidance
- Embed verification before merge Insert automated checks, static analysis, and security gates inside the agent loop so generated changes are rejected before they become accepted work.
- Define a charter for AI-generated changes Publish explicit architectural patterns, security constraints, and coding standards that the agent must receive before it writes code.
- Measure comprehension debt directly Track whether reviewers can explain why a change exists, what it changes, and how it would be diagnosed if it failed in production.
What's in the full article
Sonar's full podcast covers the operational detail this post intentionally leaves for the source:
- Ian Johnson’s day-to-day ticketing approach and how he structures AI-assisted engineering work
- The charter, hooks, and verification practices he uses to keep generated code inside acceptable standards
- The discussion of cognitive surrender and how review behaviour changes when output looks confident
- The full conversation between Tom Howlett and Ian Johnson on operating AI coding workflows at speed
👉 Read Sonar’s podcast discussion on AI code review, verification, and engineering discipline →
AI code generation and code review fatigue: are your controls keeping up?
Explore further
14/09/2026 10:11 am
AI-assisted coding is becoming a governance problem, not just a productivity problem. The article shows that once generation becomes cheap, the real control surface moves to standards, review, and enforcement. That is the same pattern identity teams already know from privileged access and lifecycle governance: speed without control produces more risk, not less. Practitioner implication: treat AI code output as governed work product, not trusted output.
A question worth separating out:
Q: Should organisations treat AI coding agents like privileged software identities?
A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.
👉 Read our full editorial: AI code generation shifts risk to verification and standards
