The golden rule: generated code is a proposal

Here is the rule that anchors the rest of this course: AI-generated code is a proposal, reviewed like any pull request, and understood before it ships. Everything else is detail.

An assistant is a fast, confident contributor who has never read your architecture, does not know your threat model, and will never be paged when the code breaks in production. You would not merge a pull request from a stranger with that profile without reading it. Generated code deserves the same bar.

Understand before you accept. If you cannot explain what a block does and why it is safe, it is not ready. The state of it works but I am not sure why is exactly the state in which vulnerabilities ship.

Review at the same standard as human code. Read it, run the tests, and put the security-relevant parts through your normal review. The origin of the code does not lower the bar.

Keep a human accountable. Speed is fine; unowned code is not. A person signs off on what reaches production and can answer for it later.

This is not distrust of the tool. It is the same discipline that makes code review work between humans. The assistant drafts, and the engineer decides. That division keeps the productivity gain while accountability stays where it belongs, with a person who understands the change.