Research Note
AI Generated Code Acceptance Framework
AI-generated code earns acceptance through repository evidence. The generator does not lower the standard for intent, correctness, security, maintainability, operations,
In this article
AI Generated Code Acceptance Framework
Acceptance principle
AI-generated code earns acceptance through repository evidence. The generator does not lower the standard for intent, correctness, security, maintainability, operations, or ownership.
The review needs extra attention to plausible but invented interfaces, unrequested scope, silent dependency additions, weakened tests, unsafe defaults, permission expansion, data leakage, and comments that describe behavior the code does not implement.
Review chain
| Gate | Reviewer question | Evidence |
|---|---|---|
| Intent | Does the diff solve the requested problem? | Requirement mapped to changed files |
| Scope | Did anything unrelated change? | Whole diff and repository status |
| Interfaces | Are calls, schemas, and contracts real? | Definitions, docs, type checks, consumers |
| Behavior | Do success and failure paths work? | Focused tests and manual reproduction |
| Security | Did trust, input, auth, secrets, or dependencies change? | Threat-aware review and scanners |
| Operations | Can it be observed, deployed, and recovered? | Logs, migration, rollback, runbook |
| Ownership | Can a maintainer explain and support it? | Named approver and review record |
Test boundary
Passing tests are necessary evidence, not sufficient evidence. Tests can be incomplete, changed incorrectly, or optimized around by the generator.
The reviewer should inspect test changes separately, run the previously passing suite, add missing failure cases, and compare generated behavior with the actual requirement.
Security boundary
NIST SSDF supports integrating security practices into the software lifecycle. OWASP supports manual security review alongside automated tools. SLSA adds source and build provenance when artifacts are distributed.
No general checklist substitutes for domain expertise, threat modeling, privacy review, or production validation when the consequences are material.
Decision record
Accept only the subset the reviewer understands and can support. Reject unexplained changes. Split mixed diffs. Preserve the requirement, diff, commands, test results, security findings, reviewer, and rollback path.
Sources
Follow the evidence.
- csrc.nist.gov: finalcsrc.nist.gov
- cursor.com: agent best practicescursor.com
- cursor.com: teamscursor.com
- cursor.com: 1 7cursor.com
- cursor.com: data usecursor.com
- cursor.com: auto reviewcursor.com
- cursor.com: securitycursor.com
- cursor.com: privacycursor.com
- daltonanderson.ghost.io: how i built a go app in 4 hours with cursor aidaltonanderson.ghost.io
- git-scm.com: v2git-scm.com
- go.dev: getting startedgo.dev
- Spotify episodeopen.spotify.com
- owasp.org: www project top 10 for large language model applicationsowasp.org
- owasp.org: www project code review guideowasp.org
- slsa.dev: v1.2slsa.dev
- daltonanderson.net: how i built a go app in 4 hours with cursor aidaltonanderson.net
- youtu.be: n4 J1tDwreMyoutu.be