The builder
An engineering organization inside one of the largest online retailers there is: thousands of engineers, and a site that is not a channel for the business but the business itself. This is the AI development gap from its second side. The team had moved on AI, hard, with a mandate to use coding assistants across the day-to-day, and it was shipping code a model wrote faster than the review that used to catch things.
In your terms: you have a real team, it ships, and it now ships changes nobody fully wrote. The thing being built was never in question. The site has existed for decades. What changed was the speed of change.
What the AI made easy
Throughput. Assistants drafting changes across services, more changes landing per week, the velocity numbers everyone had been asked to move, moving. For a while the only visible effect was the one the mandate wanted.
Then, in one week in March 2026, four high-severity incidents. One of them took checkout, account access, and pricing down for around six hours for millions of customers; others showed wrong delivery promises and lost orders. A senior vice president wrote to the technology leadership that the availability of the site had "not been good recently," described a trend of incidents with a "high blast radius," and tied them to AI-assisted changes and to novel uses of the tools "for which best practices and safeguards are not yet fully established." The remedy that followed: junior and mid-level engineers may no longer push AI-assisted changes to production without a senior engineer's sign-off.
That remedy is a name. It names, after the fact, the person who answers for a change a model helped write. Until that week nobody had. The customers who could not check out were answered for by an email.
The check
Every resource runs the same three rows. Founder judgement decides the first. Engineering judgement decides the third. Observation connects them.
| Row | Verdict | Evidence |
|---|---|---|
| Originated itShould this exist, in this form? | held | The changes were legitimate work on a product that exists and earns. Nobody built the wrong thing. Founder judgement had nothing to decide here. |
| Observed itWas anyone reading the work while the AI produced it? | surrendered | Review was sized for the volume of human-written change. Changes now landed faster than anyone could read them, and a clean, confident diff read as a reviewed one. The model's fluency stood in for verification. |
| Answered for itWill it hold, and who stands behind it when it ships? | surrendered | No one was named as standing behind an AI-assisted change until the outage forced the naming. The fix, senior sign-off, is answerability installed in arrears. |
Four flaws, none of them exotic, all of them made easy by a tool that never slows down:
- Review sized for yesterday's volume. The process assumed a person wrote every change and a person read every change. Double the changes and the second half of that sentence quietly stops being true.
- Confidence mistaken for verification. AI-written code arrives finished-looking: named well, commented, tested in its own telling. A tidy diff is not a reviewed diff. It is a claim with good manners.
- Blast radius unpriced. The change that touched checkout went through the same door as the change that touched a log line. Nothing in the process asked how much of the business a change could take down with it.
- The answerer named after the incident. Senior sign-off is the right rule. It was written the week after. The gate existed only once something had already gone through it.
What judgement would have decided
What an experienced builder would have set up the week the mandate landed, not the week after the outage:
- EngineeringPrice the blast radius before the change, not after. Every change declares what it can take down. Anything that touches checkout, pricing, identity, or money takes a different path than the rest, with a real person running it before it ships.Costs: a classification step on every change, and a visibly slower path for the risky tenth of them.
- EngineeringReview what the change can break, not how the diff reads. For AI-written change the reviewer runs it, in an environment that looks like production, rather than reading it for style. Reading is what the model is good at fooling.Costs: reviewer time, which becomes the bottleneck the assistants were supposed to remove.
- EngineeringName the answerer at merge, not at the post-mortem. Every production change carries a person who can explain it in their own words, without the assistant. If nobody can, it does not ship yet.Costs: the throughput the mandate promised, cut back to what people can explain.
- FounderDecide what the speed is for. Velocity was the mandate. Velocity toward what, and in which parts of the estate? That is a leadership decision: which systems may move at agent speed and which never will.Costs: admitting that the mandate was a means, and saying so to the people who were measured on it.
- EngineeringRehearse the rollback per radius. The systems with the largest radius get a rehearsed, timed way back, run before anyone needs it.Costs: an afternoon per system, repeated when the system changes.
Where the fast path was right
Using assistants for most of the estate. Most changes in an organization that size touch log lines, internal tools, and glue, and agent speed there is a gift with almost no radius. The mandate was not wrong; it was unbounded.
The fix relocates the risk. The senior engineer is now the slowest step and the single point of failure, and the attention of a few people is what the site's availability rests on. That is the trade: fewer changes per week in the places that matter, and a person's name on each of them, in exchange for finding out about blast radius before checkout goes dark.
On the public record, March 2026, names removed. Written with AI assistance; the judgement is mine. — Clay