Your AI coding agent opens pull requests faster than your team can review them. That is the productivity win everyone advertised, and it is also the problem nobody planned for.
Review capacity, not generation capacity, is now the bottleneck. The fix is not more reviewers. It is making CI catch the things humans are bad at spotting when they are tired and the queue is twelve deep.
What the Research Says You Should Look For
Recent analysis of AI-era codebases found duplication up 81% and code reuse down 70%. Other studies put the duplication increase as high as eightfold. Forrester expects around 75% of technology decision-makers to be dealing with moderate to severe technical debt this year, with AI-generated code volume climbing toward 60% of new code.
Notice the shape of that damage. It is not syntax errors, which compilers catch. It is a model writing a perfectly good function that already existed three directories over.
The Five Checks Worth Adding
- Duplication detection with a hard threshold. Fail the build when a change adds a block that closely matches existing code. This is the single highest-value guardrail available right now.
- Dependency diff review. Agents add packages casually. Any new dependency should require explicit human sign-off, every time.
- Test quality, not just coverage. Agents write tests that assert the code does what it does. Mutation testing on critical paths catches tests that cannot fail.
- Secret and credential scanning. Non-negotiable, and doubly so when generation is fast enough that nobody reads every line.
- Diff size limits. A 2,000-line pull request will not be reviewed properly by anyone. Cap it and force the agent to split the work.
The Cultural Guardrail Nobody Codifies
The 2025 DORA research found around 30% of developers report little to no trust in AI-generated code. That distrust is healthy and it needs somewhere to go.
Make authorship visible. Label pull requests that were largely agent-generated, so reviewers know to look for the specific failure patterns: reinvented utilities, swallowed exceptions, and legacy code left untouched because the agent worked around it rather than through it.
Where to Let the Agent Run Free
| Change type | Autonomy level |
|---|---|
| Test additions for existing code | High. Merge on green. |
| Documentation and comments | High |
| Dependency version bumps | Medium. Automated tests plus review. |
| Refactors within one module | Medium |
| New public interfaces | Low. Human design review first. |
| Anything touching auth or payments | Low. Always human, always two eyes. |
Conclusion
Add duplication detection with a failing threshold this week, because it catches the dominant failure mode of AI-written code. Require sign-off on new dependencies, cap diff sizes so review stays real, and label agent-authored pull requests so reviewers know what to look for. Speed at the generation step means nothing if it simply relocates the cost to a maintenance bill two years out.
Frequently Asked Questions
Should we let agents merge their own pull requests?
For tests and documentation on green builds, that is defensible. For anything else, no. The failure mode is not a broken build, it is a working change that quietly makes the codebase worse.
Does more code review fix this?
Not on its own. Human reviewers are poor at spotting duplication across a large codebase and excellent at spotting bad design. Automate the first, protect their time for the second.
Is the productivity gain real?
Yes, at the point of writing. Whether it survives contact with maintenance depends entirely on whether you added guardrails in the first six months or the third year.