How do you decide what to let Claude Code fully own vs. review line by line?
by•
Solo builder here, using Cursor + Claude Code as basically my whole engineering team. Six months in I still don't have a good instinct for this: some days I let it just run with a whole feature and barely glance at the diff, other days I'm rereading every line like it's a junior dev's first PR.
Right now my rough rule is billing/auth code gets the paranoid review, UI and analytics panels get the "looks fine, ship it" treatment. But that's just a gut feeling, not a real system.
Anyone here have an actual framework for this, or is everyone just winging it based on vibes and how burned they've been before?
101 views
Replies
the "AI code that's wrong looks confident and clean" point below is the real tell. we run every Claude Code diff through a second agent with different instructions asking it to find the one change it would revert - catches maybe 1 in 5 that would've slipped a normal read-through.
the billing/auth-gets-paranoid-review split matches what's usually risky, but the category that's burned me even though it reads like boring plumbing is anything that takes another user's id as a parameter — a share link, or a bulk-export endpoint. those don't read as security-sensitive, so they get the fast pass, and that's exactly where a query without a scope check slips through unnoticed. what's the closest thing that's slipped into your ship-it pile?
The risk split is a good start, but risk is the second question. The first is: do you actually know how this work should be done, and how often will you run it? If you know the procedure and run it often, that's the part worth turning into a fixed, repeatable process instead of re-deciding by gut every time. Let the agent own what's genuinely unknown or one-off, and bound what you already understand. Chained autonomous steps compound errors fast, so the steps you can pin down are exactly the ones you should.