AI-generated code can be syntactically clean and still be wrong for the project. It may handle the demonstration case while failing on empty data, expose information in the browser, duplicate existing logic, or add a dependency that is difficult to maintain. Review is the point where generated output becomes software you are willing to own.
Read the change as a data journey
Identify where each value begins, how it is transformed, where it is stored, and where it is displayed. Mark every trust boundary: browser to server, server to external service, file to parser, and user input to rendered HTML. Confirm types and optional values. If you cannot describe the journey in plain language, the change is not ready to approve.
Verify behavior against the specification
Run the acceptance checks created before implementation. Test the normal path and intentionally test absence, duplication, invalid formats, long content, slow responses, and repeated actions. Watch the console and network panel even when the screen looks correct. A silent failed request or repeated event listener may not be visible in a quick demonstration.
Inspect security assumptions
Search for credentials, tokens, private URLs, raw database errors, and user content inserted as HTML. Confirm that authorization is checked on the server for every protected operation. Client-side validation improves usability but never proves permission. Check that outbound requests use expected destinations and that logs do not contain confidential data.
Review accessibility and interaction
Use the feature without a mouse. Confirm controls have visible labels, focus is visible, status changes are announced when needed, and color is not the only signal. Zoom text to 200 percent and test a narrow viewport. Generated interfaces frequently look polished at one desktop size while becoming difficult to use with different input methods or text settings.
Reduce unnecessary complexity
Ask whether the change created duplicate helpers, new global state, speculative configuration, or a library for a task the platform already supports. Prefer the smallest approach that follows existing project patterns. Remove commented experiments and unexplained constants. Add a comment only where the reason for a choice would otherwise be unclear.
Finish with evidence
Record the files changed, checks run, cases tested, and remaining limitations. For important logic, add automated tests; for interface work, keep a short manual checklist. A useful review result is not ‘the code looks good.’ It is a traceable statement that the required behavior worked under defined conditions and that known risks were examined.