The Last Human Code Review: Building Trust in AI-Generated Code — Itamar Friedman, Qodo
Automated code review depends less on a stronger model than on codifying team rules, architecture, incidents, and service contracts into context both humans and agents can inspect.
Friedman argues that review must still validate safety and maintainability while supporting team learning. Generic models lack the local context held in rules, architecture, service contracts, incident history, discussions, and developers’ heads; he proposes a shared **context engine** for both humans and agents.
Codify standards where they apply in the software graph, show which rules each review used, and track whether those rules produce useful findings. Automate gradually: the proposed readiness signal is roughly **100 pull requests** with declining human-comment activity before moving toward automatic approval or blocking.
Friedman argues that review must still validate safety and maintainability while supporting team learning. Generic models lack the local context held in rules, architecture, service contracts, incident history, discussions, and developers’ heads; he proposes a shared **context engine** for both humans and agents. Codify standards where they apply in the software graph, show which rules each review used, and track whether those rules produce useful findings. Automate gradually: the proposed readiness signal is roughly **100 pull requests** with declining human-comment activity before moving toward automatic approval or blocking. This is a vendor’s operating model, not evidence that human review can be removed safely across teams. Knowledge can be stale or incomplete, and the talk does not establish how the suggested readiness signal predicts production defects or outages.
This makes locally scoped, inspectable organizational knowledge a prerequisite for increasingly automated review. It reinforces candidates that preserve decisions and encode recurring feedback, but adds rule attribution and usefulness tracking. The proposed 100-PR readiness signal remains an operational heuristic, and stale context plus cross-PR attacks leave unresolved whether declining human comments indicate production safety.