AI Wrote 800 Lines. How Much Should Actually Ship?
By Obaid Tariq, Founder & Lead Engineer · Published
The short answer
Ship the smallest amount of AI-generated code that meets the requirement, passes tests that prove it, and that a person on your team fully understands. That can be much less than an agent first produces, because agents readily add duplication, speculative abstractions and code nobody asked for. The fix is a human-led workflow: write the requirement and acceptance tests first, keep each pull request small, review every diff against a checklist, and judge success by delivery and stability metrics rather than lines of code.
An AI agent wrote 800 lines of code. How much of it should actually ship?
Only the code that is needed to meet a written requirement, is covered by tests that would fail if it broke, and that a reviewer on your team understands line by line. Everything else, including speculative helpers, duplicated logic and unused branches, should be deleted before merge. There is no fixed percentage; the right amount is whatever the requirement needs and no more. An 800-line diff is also a signal that the task was too big for one pull request.
More code is a cost, not an output
AI coding agents make writing code cheap. They do not make reading, reviewing, testing, securing or maintaining it cheap. Every line that ships is a line someone has to understand during the next incident, the next upgrade and the next feature. That is why we treat the size of an AI-generated diff as a cost to be justified, not as a measure of progress.
The best evidence on this comes from DORA, Google Cloud's long-running software delivery research programme: its 2024 report found that AI adoption improved individual productivity, flow and job satisfaction, but negatively affected software delivery throughput and stability, and it concluded that fundamentals such as small batch sizes and robust testing remain crucial.
Why agents overproduce
- They solve the problem they imagine, not the one you have. Without a precise requirement, an agent fills gaps with plausible features: extra configuration options, retry logic, caching or admin screens nobody requested.
- They don't know what already exists. An agent that hasn't found your existing date helper or permission check will often write a new one, so the codebase ends up with two slightly different versions of the same rule.
- They stop when the work looks done. Anthropic's Claude Code documentation makes this point directly: without a check it can run, looking done is the only signal the agent has. Plausible-looking code that misses edge cases is the result.
- Review prompts can make it worse. The same documentation warns that a reviewer asked to find gaps will usually find some, and that chasing every finding leads to extra abstraction layers, defensive code and tests for cases that can't happen.
Step 1: requirements first, then code
Most of the 800 lines that shouldn't ship were never asked for. The cheapest place to remove them is before they exist. Before an agent writes anything, write down in plain language what the change must do, who is allowed to do it, what is explicitly out of scope, and how you will know it works. Anthropic's guidance recommends a similar sequence: explore the code, agree a plan, then implement, and it notes that the most useful specs state what is out of scope and end with a verification step.
Step 2: tests are the definition of done
Turn each acceptance criterion into a test before or alongside the implementation, and include the unhappy paths: the wrong user, the empty list, the oversized input, the expired session. Then the question "how much should ship?" has a concrete answer: the least code that makes those tests pass and keeps the rest of the suite green. Code that no test exercises and no requirement explains is the first candidate for deletion.
Google's published code review guidance adds a useful test of the tests: check that they would actually fail if the code broke, and don't accept complexity in tests just because they aren't production code. AI agents can generate hundreds of shallow tests quickly. A smaller set that pins down the real behaviour is worth more. Where each test should sit (unit, integration or end-to-end) is covered in our modern web development workflow guide.
Step 3: keep pull requests small
Google's engineering practices recommend small, self-contained changes because they are reviewed faster and more thoroughly, are less likely to hide bugs and are easier to roll back. The guide suggests that 100 lines is usually a reasonable size and 1,000 lines is usually too large, while leaving the final call to the reviewer, and notes that a change spread across many files can be too large even when the line count is modest. By that standard, an 800-line AI diff should normally be split.
| Pull request | Contents | What the reviewer checks |
|---|---|---|
| 1. Data and permissions | Migration, query and the server-side permission check, with tests for allowed and denied users | Access is denied by default; the migration is backwards compatible |
| 2. Core logic | The CSV formatting and row limit, with unit tests including empty and oversized cases | No duplicated helpers; edge cases tested |
| 3. API route | The endpoint wiring the logic to the permission check, with an integration test | Input validation; errors don't leak internals |
| 4. User interface | The export button, loading and error states | Behaviour on the preview deployment, keyboard and mobile |
| Deleted before merge | Unrequested caching layer, a generic exporter base class, an unused PDF stub | Nothing; it never reaches review |
Splitting also makes the agent better. A narrow task with its own tests gives the agent a clear finish line and gives the reviewer a diff they can hold in their head.
Step 4: measure code health, not lines of code
If a team celebrates lines written or pull requests opened, AI agents will make those numbers rise while the product gets harder to change. Measure outcomes instead. DORA's software delivery metrics are a good default because they balance speed against stability:
| Metric | What it tells you | Warning sign with AI-generated code |
|---|---|---|
| Change lead time | How long a change takes from version control to running in production | Falls at first, then rises as review queues fill with large diffs |
| Deployment frequency | How often you deploy | Fewer, bigger deploys because changes are bundled |
| Change fail rate | Share of deployments needing an urgent fix such as a rollback or hotfix | Rising while output rises |
| Failed deployment recovery time | How long it takes to restore service after a failed deployment | Longer, because nobody fully understands the code that failed |
| Deployment rework rate | Share of deployments that are unplanned and caused by a production incident | More unplanned fix-up releases |
Alongside these, we watch a few code-level signals in review: net lines added per feature, how often the same logic appears twice, how many new dependencies arrive, and whether each change leaves the area it touched easier or harder to understand. Google's review standard is a good north star: approve a change once it definitely improves the overall code health of the system, even if it isn't perfect.
What should reviewers look for in an AI-generated pull request?
Review an AI-generated pull request as if a capable but new contractor wrote it: read every line, and look hardest for duplication and bloat, unnecessary abstractions, dead code, missing edge cases, missing or client-side-only permission checks, and new dependencies. Check that the tests would fail if the code broke and that the change matches the requirement and nothing more. Then confirm it works on a preview deployment and in production before calling it done.
The reviewer's mindset
Google's guidance asks reviewers to read every line they are assigned, to be especially vigilant about over-engineering, and to make sure they understand what all the code is doing, asking the author to clarify anything they can't follow. If part of the change needs expertise the reviewer lacks, such as security or concurrency, someone qualified should review that part. All of this applies with extra force to AI output, because the author can produce more code than a person would and won't push back when a question exposes a weak assumption.
We also recommend an automated first pass. Anthropic's documentation suggests reviewing an agent's diff in a fresh context, for example a separate session or subagent, so the reviewer isn't biased towards code it just wrote. That review is a helpful filter; in our view it supplements a human reviewer and does not replace one.
Review checklist for AI-generated pull requests
| Check | What to look for | Typical fix |
|---|---|---|
| Scope | Changes or files unrelated to the ticket; features nobody asked for | Remove them or move them to their own ticket |
| Duplication and bloat | New helpers that repeat existing ones; copy-pasted blocks with small differences | Reuse the existing function; delete the copy |
| Unnecessary abstractions | Base classes, factories, plugin systems or config options with a single use | Inline the code; add abstraction when a second real use appears |
| Dead code | Unused exports, unreachable branches, commented-out code, stubs for future features | Delete it; Git keeps the history |
| Edge cases | Empty, null, very large or duplicate inputs; time zones; concurrent requests; partial failures | Add a failing test, then handle the case |
| Authentication and permissions | New data access without a server-side check; checks only in the UI; queries not scoped to the current user or organisation | Enforce on the server, deny by default, test the denied case |
| Input validation and errors | Unvalidated request bodies; error messages that expose stack traces or internal IDs | Validate at the boundary; return safe, specific errors |
| Dependencies | New packages, especially for small tasks; unfamiliar or barely used packages; version jumps in the lockfile | Justify each one or remove it; check it in dependency review |
| Secrets and config | Hardcoded keys, URLs or credentials; new environment variables without documentation | Move to environment config; rotate anything exposed |
| Tests | Tests that only assert the code runs; mocks that hide the real behaviour; missing failure cases | Assert real outcomes; check each test fails when the code is broken |
| Readability | Names that don't describe purpose; comments that restate the code instead of explaining why | Rename; replace comments with intent |
| Data changes | Migrations that drop or rewrite data; changes that aren't backwards compatible during deploy | Split into safe steps; confirm backups and rollback |
Authorisation deserves its own pass
Broken access control is ranked first in the OWASP Top 10 for 2025. OWASP's prevention advice is to deny by default except for public resources, to enforce access control in trusted server-side code because client-side checks can be bypassed, and to include functional access control in unit and integration tests. For every new route, server action or query in an AI-generated diff, ask: who is allowed to call this, where is that enforced, and is there a test proving that someone else is refused? An agent that hides a button for non-admins but leaves the API open has not built a permission check.
Dependencies: every new package is a long-term commitment
Agents often reach for a package where a few lines of code, or a library you already use, would do. Each addition brings updates, vulnerabilities and licence questions. Before approving one, confirm that it is genuinely needed, that it is the package you think it is (check the exact name on the registry), and that it is maintained. On GitHub, dependency review shows added, removed and updated dependencies in a pull request with any known vulnerabilities, and the dependency review action can fail a check when a vulnerable version is introduced; that check blocks merging only if branch protection requires it to pass.
Production checks: done means working for users
- CI is green: type check, lint, tests, build and dependency scanning all pass on the final commit.
- The preview deployment behaves correctly, including the denied-permission case, empty states and mobile.
- Risky changes are behind a feature flag so they can be switched off without a redeploy.
- Error tracking and logs are watched for the first hour after release, with someone who can act on alerts.
- The rollback route is known, including what happens to any data a migration changed.
- Follow-up deletions are ticketed. If a temporary path or flag was added, schedule its removal.
The mechanics of CI, preview deployments and releases are covered step by step in our day-to-day workflow guide. If you have inherited an app built mostly by AI and are unsure what is safe to keep, see the risks of shipping AI-generated code. Setting up agents with good repository context is a separate topic, covered in our AI coding agent workflow guide.
If you want a quick read on how close an existing app is to production, our free app readiness checker is a reasonable first step.
Frequently asked questions
Is AI-generated code safe to ship to production?
It can be, if it goes through the same process as any other code: a clear requirement, tests that prove the behaviour, a small pull request, a human reviewer who understands every line, passing CI checks and monitoring after release. The risk comes from skipping those steps because the code was quick to produce.
How big should a pull request be when using AI coding agents?
Small enough that a reviewer can understand all of it in one sitting. Google's engineering practices suggest about 100 lines is usually reasonable and 1,000 lines is usually too large, with the reviewer making the final call. Split large AI-generated changes into separate pull requests for data, logic, API and interface.
Should we measure developer productivity by lines of code now that AI writes more of it?
No. Lines of code rise easily with AI agents and say nothing about whether the software improved. Delivery and stability measures such as DORA's change lead time, deployment frequency, change fail rate, failed deployment recovery time and deployment rework rate are better indicators.
Can AI code review tools replace human reviewers?
In our view, no. Automated and fresh-context AI reviews are a useful first pass for common mistakes, but a person who understands the product should approve every merge, especially changes to authentication, permissions, payments, data deletion and dependencies.
What is the most common serious problem in AI-generated pull requests?
Missing or incomplete authorisation checks are among the most serious problems to look for: data access that is only protected in the user interface, or queries not scoped to the current user or organisation. OWASP ranks broken access control first in its 2025 Top 10, so every new route or query deserves a denied-access test.
Sources
- Google Engineering Practices: Small CLs — Benefits of small changes; 100 lines usually reasonable, 1,000 usually too large, reviewer's judgement; file spread matters. Accessed 20 October 2026.
- Google Engineering Practices: What to look for in a code review — Read every line; vigilance about over-engineering; understand all the code; qualified reviewers for security; tests that fail when code breaks. Accessed 20 October 2026.
- Google Engineering Practices: The Standard of Code Review — Approve once a change definitely improves overall code health, even if not perfect. Accessed 20 October 2026.
- Claude Code documentation: Best practices — Give the agent a way to verify its work; explore, plan, then code; specs with scope and verification; fresh-context review; over-engineering from chasing review findings. Accessed 20 October 2026.
- DORA: Accelerate State of DevOps Report 2024 — AI adoption linked to higher individual productivity but negative effects on delivery throughput and stability; small batches and robust testing remain crucial. Accessed 20 October 2026.
- DORA: Software delivery performance metrics — Definitions of change lead time, deployment frequency, change fail rate, failed deployment recovery time and deployment rework rate. Accessed 20 October 2026.
- OWASP Top 10 2025: A01 Broken Access Control — Broken access control ranked first; deny by default; server-side enforcement; access control in unit and integration tests. Accessed 20 October 2026.
- GitHub Docs: About dependency review — Dependency changes and known vulnerabilities shown in pull requests; dependency review action fails on vulnerable versions; blocking requires branch protection. Accessed 20 October 2026.
Recommendations without a source are AI Dev Planner’s own engineering opinion. Platform features and prices change; check the linked pages for the current position. Found an error? See our corrections policy.
Related guides
- AI, Vibe Coding & the Future of SaaSWhat a Production-Ready AI Coding-Agent Workflow NeedsContext files, team rules, skills, MCP servers, tests as the verification loop, sandboxes, scoped permissions and human approval, with a staged rollout for small teams.
- Career, Learning & Web Development FundamentalsThe Modern Web Development Workflow, Day to Day: From Ticket to ProductionBranches, pull requests, CI checks, preview deploys, AI agents with review, testing, releases and monitoring, step by step.
- AI, Vibe Coding & the Future of SaaSRunning a Vibe-Coded App in Production: Maintenance, Scaling and Security RisksWhat to fix first when real users arrive, and the security, architecture and edge-case risks of pure AI-generated code.
- AI, Vibe Coding & the Future of SaaSIs SaaS Dead Now That Anyone Can Vibe-Code an App?What AI-generated code really threatens in SaaS, what it doesn't, and how to tell which side your product is on.
Browse all 76 questions in the SaaS & web development guide.
Inherited a pile of AI-generated code?
We review AI-assisted codebases the way this article describes: requirements, tests, small changes and a careful look at permissions and dependencies. Tell us what you have and we will tell you what we would keep, fix or remove.