Reviewing agent-generated code before it reached users

An AI coding agent implemented a feature merging two related but different task types into one system. Reviewing it line-by-line against the actual permission and visibility rules surfaced 17 defects before release.

Among them: a missing configuration value that broke every endpoint for the new feature, a visibility check that could leak a task to the wrong user, notifications routed to the wrong recipient, and an N+1 query hiding in a background job.

None of these would have shown up in a demo; they only show up when you read generated code as carefully as you'd read your own.