AI Writes Code Faster Than Your Team Can Review It with Andrew Norrish, Sourcegraph

As AI writes an increasing share of code, code review and context gaps become the new bottleneck, driving a rise in AI-initiated production incidents; SRE an

AI Writes Code Faster Than Your Team Can Review It: The Shift from Generation to Comprehension Bottlenecks in Software Engineering

Abstract

As generative artificial intelligence (AI) assumes a growing share of software authorship, the rate-limiting constraint on engineering organizations has migrated from code production to code comprehension and review. This synthesis examines evidence that the volume and size of pull requests (PRs) have roughly doubled under agentic coding workflows, that review time has scaled proportionally, and that a measurable increase in production incidents is now traceable to AI-generated changes. It is argued that Site Reliability Engineering (SRE) and platform teams occupy a dual role in this transition: they function as the empirical barometer of AI code trustworthiness, absorbing its failure modes as incident load, while simultaneously representing the organizational function best positioned to benefit from AI, owing to their long-standing practice of operating well-bounded, semi-autonomous workflows. An investigation-prevention-remediation framework, grounded in whole-codebase code-graph indexing, is presented as a tooling response, with illustrative production deployments.

1. Introduction

The discourse surrounding AI in software engineering has undergone a notable reframing. Where early enterprise AI roadmaps were dominated by headcount-reduction analysis, that framing appears to be receding: at Sourcegraph's most recent customer advisory board, the question of how many engineering roles AI could displace reportedly did not arise for the first time. This absence is significant not as an isolated anecdote but as a signal that organizations have begun to locate their constraints elsewhere.

Several terms warrant definition at the outset. Agentic coding refers to workflows in which large language model (LLM)-driven agents autonomously generate, modify, and submit code changes with limited per-step human intervention. Code intelligence denotes structured, cross-repository knowledge of symbol definitions, references, and change history, as distinct from unstructured textual search. Toil, in SRE terminology, describes manual, repetitive operational work that scales linearly with service growth rather than diminishing through automation.

The central thesis advanced here is that review capacity and context availability - not generation capacity - now determine the safe throughput of software organizations, and that operational teams are the first to register the consequences of this shift, both as victims of degraded code quality and as the primary beneficiaries of AI applied to narrower, better-bounded problems. This analysis proceeds by establishing the empirical background of the review bottleneck, examining the resulting trust gap and operational burden on SRE teams, identifying where AI demonstrably succeeds versus fails, and presenting a tooling framework - investigation, prevention, and remediation - built on full-codebase code-graph indexing.

2. Background and Related Work

Two prior conditions frame the present analysis. First, organizations have committed substantial budgets to AI tooling and, consequently, expect heavy utilization to justify procurement - a dynamic that incentivizes the volume of AI-generated output somewhat independently of its reviewability. Second, codebases have expanded rapidly as developer velocity increased under AI assistance, compounding the context-retrieval problem on which thorough review depends.

Relevant to the question of comprehension, Anthropic has reported that as developers rely more heavily on AI for code authorship, their comprehension of the resulting code declines. This finding is consequential because review quality is bounded by reviewer understanding; a decline in comprehension therefore erodes the primary control organizations rely upon to catch defects before deployment. Projections indicating that roughly two-thirds of code will be AI-written by 2027 suggest this pressure will intensify. Notably, SRE and platform engineering practice already contains a developed precedent for constrained, well-scoped automation - automated remediation, incident response runbooks, and CVE monitoring - predating the current wave of generative AI tooling, which positions these teams as a natural proving ground for the present transition.

3. Core Analysis

3.1 The Review Bottleneck and Its Quantified Growth

PR counts and PR sizes have ballooned under agentic coding: customers estimate close to a twofold increase in the number of PRs merged, with sizes exceeding twice that of human-authored PRs. Developers report spending nearly twice as much time on code review as a direct consequence. Critically, the operative pressure on developers is less about establishing trust in AI-written code than about managing a growing backlog - "getting ahead of a growing PR backlog matters more to developers than whether they actually trust the code." This dynamic is compounded by a structural mismatch: AI-written code is frequently not organized or commented in a manner optimized for human review, since it was not necessarily written with a human reader as the primary audience, making review itself slower and less reliable per unit of code examined.

3.2 The Trust Gap and Its Operational Consequences

Almost every developer surveyed reports some degree of distrust in AI-written code, yet nearly half admit they do not always verify it before merging. This combination - widespread skepticism paired with inconsistent verification - produces a predictable outcome: AI-written PRs lacking organizational and large-codebase context "needed to actually be production-quality gets merged into production without a human ever seeing it more often than not now." The consequence is observable in operational metrics: incidents increasingly trace back to AI-generated PRs, with corresponding growth in rollbacks and hot fixes.

This burden falls disproportionately on SRE and platform teams, who resolve incidents without runbooks, frequently in code no human has reviewed. Incidents are reported as more frequent, slower to resolve, more prone to recurrence, and more costly. Organizational responses - primarily hiring additional SREs - function as a palliative rather than a structural fix, since the role is already expensive and in high demand, with hiring capacity unable to keep pace. Cross-service problems compound the difficulty, as root-causing issues across service boundaries pushes teams toward slow, error-prone manual commit scanning, and fixes discovered in one repository frequently need replication across hundreds or thousands of others - a scaling problem distinct from, but related to, the review bottleneck itself. Stakes are elevated further in regulated environments, such as financial institutions, where compliance requirements raise the cost of unreviewed or poorly understood code reaching production.

3.3 Where AI Demonstrably Succeeds

A central distinction emerging from this evidence is between broad, end-to-end automation of software development - where AI "underperforms" - and well-bounded domains with full necessary context, where AI "is winning a whole lot more." Cited examples of the latter include vulnerability remediation, security scanning, large-scale migrations, and non-developer prototyping. This distinction maps directly onto existing SRE and platform practice: these teams have long operated in constrained, semi-autonomous workflows (automated remediation, incident response runbooks, CVE monitoring) that predate AI adoption but are structurally suited to it. Consequently, SRE and platform teams serve a dual function: they are the barometer for how trustworthy AI-generated code is within an organization, measured by the incidents it produces, and they are simultaneously positioned to realize the largest productivity gains from AI when its scope is appropriately narrowed.

4. Technical Insights

The tooling response presented here organizes around three functions - investigation, prevention, and remediation - built atop a full code graph indexing an organization's entire codebase across every repository, branch, and commit. This architecture supports two complementary search modalities: deterministic code search, which executes a single query across the full historical corpus, and an agentic "deep search" feature designed to produce cited, confident answers for less structured queries. This code context is exposed to agents through an interface referred to as an "LMT P" (code context engine), allowing agentic tools to query organizational code history rather than operating solely on local context.

Implementation trade-offs are evident in the customer deployments described. One enterprise customer (5,000+ developers) built a root cause analysis agent that activates on service downtime or error-rate spikes, identifies the actual deployed branch or tag in production (which is often not the main branch), and uses agentic search over git history to isolate the triggering commit and its author, enabling revert/redeploy actions or handoff to SRE triage. A second customer constructed a custom code review agent for a large monorepo using a read-only code finder agent capable of searching hundreds of historical branches at scale, deliberately avoiding reliance on non-deterministic agentic tools for this step; only changes passing evaluation suites trigger publish processes. This design choice - preferring deterministic search where correctness matters and reserving agentic capabilities for exploratory or triage tasks - represents a recurring pattern: bounding agentic autonomy to tasks where errors are recoverable or where deterministic verification gates the final action.

5. Discussion

These findings suggest that the software engineering productivity narrative requires revision. Velocity gains from AI code generation are real but have displaced, rather than eliminated, the organizational bottleneck; the constraint has moved downstream to review, comprehension, and incident response. This reframing has practical implications for how engineering leadership allocates investment: tooling aimed purely at increasing generation throughput may worsen the imbalance unless matched by comparable investment in review and context infrastructure.

A notable gap in the current evidence concerns causal attribution - the extent to which rising incident rates reflect genuinely lower code quality from AI generation versus an artifact of review processes failing to scale alongside PR volume. Both Anthropic's reported comprehension decline and the customer-reported verification gap suggest the latter mechanism is at least partially operative, but disentangling these effects would require more granular incident post-mortems than are presented here.

The positioning of SRE and platform teams as both barometer and beneficiary of AI-driven change is a useful organizing insight for industry practice generally. It suggests that organizations evaluating AI coding tools might productively look to their operational teams' existing automation practices as a template for where AI can be deployed with acceptable risk, rather than attempting uniform rollout across all development workflows.

6. Conclusion

This analysis has argued that the principal constraint in AI-augmented software engineering has shifted from code generation to code review and comprehension, evidenced by near-doubling of PR volume and size, proportional growth in review time, and a documented rise in AI-attributable production incidents. SRE and platform teams absorb this shift most directly, both as the organizational function that experiences incident fallout and as the function best positioned to benefit from AI when its application is narrowed to well-bounded, context-rich domains.

The practical takeaway is that effective adoption of AI coding tools depends less on maximizing generation throughput and more on building context infrastructure - full-codebase code graphs, deterministic search, and bounded agentic workflows - that supports investigation, prevention, and remediation. Future work might usefully quantify the relative contribution of comprehension decline versus review-process scaling to incident growth, informing more targeted investment decisions.

Sources

• AI Writes Code Faster Than Your Team Can Review It - Andrew Norrish, Sourcegraph - Original Creator (YouTube)
• Analysis and summary by Sean Weldon using AI-assisted research tools

About the Author

Sean Weldon is an AI engineer and systems architect specializing in autonomous systems, agentic workflows, and applied machine learning. He builds production AI systems that automate complex business operations.

LinkedIn | Website | GitHub