When AI Writes 90% of the Code, Who Reviews It? Claude Code Adds Six Safety Gates

Claude Code wrote about 90% of his own code.

Writing code was replaced by AI, and the number of changes followed a surge from June to September, more than doubling the number of PRs incorporated into the code library.

Take a look at the entire Anthropic, the main source code library that combines changes every day, from about 2,500 times in May to over 30,000 times in September.

So much code has been read, and if even censorship is given to AI, who will judge if it has made a mistake?

On October 15, Claude Code's team unveiled an internal code review process, revealing that while the number of PRs doubled, the proportion of PRs that needed to be rolled back decreased by more than 40%.

To do this, they rely on six layers of inspection and a set of fast detection, fast rolling bottom mechanisms.

The Claude Code team's judgment was:

At this rate, the one-on-one trial is no longer realistic.

But they didn't cancel the censorship, instead handing over most of the code to the machine.

A piece of code written by AI must be tested, subjected to AI and security scrutiny before it goes online, and then it must be approved by humans to determine the risk.

For the Claude Code team, "Has anyone read this code?" is not an accurate question.

The real question should be:

What could be wrong with this change, and if it is, which inspection should prevent it?

One change, six checks, and finally a safety net.

The first phase, before creating the merger request (PR).

Claude had to run tests, complete construction; modify interfaces, and screen contrast design drawings.

Next, a sub-intelligent body that uses the entirely new context to review code differences, which was not involved in writing the code, was specifically tainted.

The official demand is clear:

Claude wanted to put out the execution commands and output, responding by saying "test all through".

Typical developers can do the same thing: When giving AI tasks, make it clear how to accept them.

The second link is the AI review on PR.

Several smart entities searched for bugs in parallel, and another group voted to verify.

Only comments about code style, diagnostic tips or code clearance will not be sent to PR and will be filtered directly.

When the review first went online in March, the internal PR share of obtaining substantive review comments rose from 16% to 54%.

The third step is security scrutiny.

Within the team, code review or security review finds that PR does not work unless it is shut down: either fix it or write a reason to shut it down.

The fourth phase is ongoing integrated CI checks, including code specification, type checks, platform testing and building packaging.

A common command line tool (CLI) modified may require dozens of checks before being handed over.

The problem of repeated problems will become the basis for the next inspection.

CLAUDE.md records the project schedule, REVIEW.md tells the reviewer what to focus on and what to skip to make this discovery an experience for the next review.

The same opinion is mentioned for the third time and should be included in the rules.

The fifth clause is artificial approval, which is the most crucial, the next section details.

Sixth, merging and releasing.

After passing the previous few rounds, the change will be added to the combined queue.

When it comes down to it, the system puts it in the latest version of the main branch, and all the checks run again.

This step is to prevent "everyone from having a problem, come together".

After the merger, the new features will not be rolled out to all users immediately.

It is first hidden behind the functional switch, and is only open to Anthropic's internal employees. Employees use high intensity, often encountering problems earlier than external users.

Function switching is like a general assembly, without changing the code or re-publishing it, you can decide whether to turn it on or off.

It's the bottom.

If there's a problem, pull the trigger.

The team is on weekly shifts, and every time an accident occurs, they ask: Where should this have been stopped?

So censorship didn't disappear, it became a layered examination that went through development, merger and release.

After the first four closures were completely green, the fifth, based on the risk rating, decided that the change would require the approval of several people.

Documents, documentation, internal-only functionality, as well as additional modifications hidden after switching, are low-risk, automatic review and security checks are exempt from manual approval after passing.

It takes one person to change normal products, as well as sensitive areas such as caches, automatic updates, and system prompts.

The most risky code, plus a few designated paths, requires two people.

It seems that low-risk change is now "driverless"?

It's not that simple.

The risk rating is determined by the change itself: the first classifier reads the code, determines the risk, and the second re-judges whether additional artificial approval is needed.

Sensitive paths marked by code owners, as well as all CI workflow documents, must be inspected.

There are also barriers to light approval: only those on the warehouse's "trustworthy authors" list are open, and those not on the list must find someone else to approve.

The person who commands the AI to write the code, even a reviewer, will be responsible for this change, just like the person who wrote the code himself.

Zero approval is not the same as no responsibility。

It's up to people to decide whether a function should or shouldn't be done, whether the architecture is reasonable, and whether existing checks can't cover the risk.

So the Claude Code team has a rule: the code you put in, and the problem arises, is usually corrected by you.

Prior to approval, reviewers must be clear about what the inspections have verified and what risks are not covered.

If you are not clear, do not rush to pass the bill before completing the necessary examination.

It's the same with automated scrutiny.

The PR of a CLI project went through more than fifty rounds of reviews and corrections overnight, and was eventually cancelled manually by the author.

You can ignore a small problem for a second, but AI won't, and it will actually change, and change again, and again, and again, and again, and again, and again.

The team re-examined the problem with git blame and found that about 59% of the problems repeatedly labeled by the censor were old code that existed before the first round of censorship. It rarely found new bugs, only digging out a few old ones every round.

And then they changed the four rules:

The three rounds have not yet passed, prompting the authors to take a step back and rethink their plans.

After the previous rounds, only further modifications were considered;

The same question once pointed out;

The question is not repeated.

The effect was immediate.

The percentage of internal PR passed after one round of reviews and corrections rose from 65% to 78%; five rounds or more were required, decreasing from 8.9% to 1.5%; the average number of reviews decreased from 2.08 to 1.32.

Following the adjustment of the review rules, the pass rate for a round of reviews and corrections increased from 65% to 78%, and the average number of reviews decreased from 2.08 to 1.32.

Half of them are looking for questions, half of them know when to ask questions.

Is there anything wrong with a multi-layered review?

Anthropic itself gives a counter-example.

On March 26, Claude Code uploaded an optimization: the session was postponed for more than an hour to clear an old logical record.

But a bug causes it to clean up every round of the conversation after it resumes. As a result, Claude becomes forgetful, starts repeating, and the tools become abnormal. This bug is not fixed until April 10.

After the suspension, the old reasoning should only be cleaned once, but in practice it is cleaned continuously every round; the red box marks the incorrect deletion of the content.

The official reshuffle on April 23 acknowledged:

This change went through multiple rounds of artificial and automated scrutiny, unit testing, end-to-end testing, and uninterrupted internal testing, which took more than a week to confirm the root cause.

It's the turn of the century.

The team re-examined the PR with Code Review, and when Opus 4.7 found the bug in context, Opus 4.6 did not find it.

This feedback, model capability, and context integrity all affected the results of the detection.

Today, every accident becomes a problem.

The team collected the PR and identified the bugs individually by engineers familiar with the code.

The examiner runs the test on a daily basis. Every time the adjective, tool or model is adjusted, it must also be used to test the results: the results are not improved and this adjustment is not used.

The team didn't finish.

After switching to online, it's up to developers and staff to combine the data boards to find the abnormalities.

The "monopoly" mechanism for automatic tightening of approvals based on indicators such as rollover rates has not yet been built.

It is also important to ensure that inspections, detections and remedies are carried out.

One member of the Claude Code team explains: "It's true that slowing down makes fewer mistakes, but it's mainly because you're doing less.

AI censorship only gives opinions, applause or you.

So don't rush after "no need to look", but let AI answer three questions each time it delivers.

First, how is it verified?

What checks have been run, what the results are, what situations have not been covered.

The creator of Claude Code, Boris Cherny, has said that giving Claude a way to verify himself is probably the most important thing. He estimates that this will make the final result two to three times as good as the original.

Boris Cherny suggested that Claude verify the work himself, forming a feedback loop; he estimated that the quality of the final result could be upgraded to 2 tons 3 times.

Second, where will it affect?

Changes involve which users, data and permissions.

For AI to add a shared feature to the reporting tool, it is necessary to ask clearly: who can open the link and what can be seen after it is opened.

Third, how to remove the error? Can't turn off the new feature with one click and go back to the previous version.

The first step is to submit an archive and make as few changes as possible.First, we can withdraw, and then we can talk about the trial.

In addition to these three issues, three more habits were developed.

First, another "brain" review.

It's easy to ignore your own bugs when writing code.

Starting a new session, or having the sub-smart body review the entire context, local/code-review and/security-review commands can also run directly.

Secondly, change the ranking.

Changing the text, styling, checking through, and merging after the actual effect is confirmed; logging in, paying out, and deleting data involves artificially scrutinizing critical logic and supplementing targeted testing.

First of all, the verification and roll-back process went smoothly, and then the gradual reduction of low-risk personnel reviews.

The third and third rounds, however, changed their minds.

The AI has changed the three rounds and is still playing, don't call it the fourth round, first ask if the scheme itself is wrong.

Most importantly, AI says "pass" and it doesn't mean you've already completed the acceptance.

The code is what you made it write, and you're responsible for the results after it's uploaded.

The goal of the Claude Code team is to get as many PRs as possible involved while maintaining rollback and accident rates.

People's attention should be focused more on judging risks, verifying whether checks are adequate, and how to correct mistakes.

You can't read every line of code, but every time you go online, someone has to be responsible.