The PR looked clean. An AI-generated endpoint for updating a user's account settings, complete with input validation and a tidy set of tests. Everything passed. A junior engineer would have merged it.
Our reviewer stopped on one line. The handler pulled the account ID from the request body instead of the authenticated session. The code worked in every test case because every test used a matching ID. In production, it would have let any authenticated user modify any other user's settings by changing a number in the payload. The AI had written functioning code that was also a straightforward access-control vulnerability.
That catch took about ninety seconds. It came from a senior engineer who had seen that exact class of bug before and knew to check where the ID came from, not just whether the code ran. This is the pattern we see over and over: the AI produces something that works, and a human with judgment catches the thing that would have hurt you.
AI Makes Senior Engineers More Valuable, Not Less
The teams shipping the fastest aren't the ones with the most AI tools. They're the ones with senior engineers who know how to wield AI tools effectively.
A senior engineer using Cursor or Claude can produce in a day what used to take a week. Not because the AI writes perfect code — but because the senior engineer knows which suggestions to accept, which to modify, and which to reject entirely.
Junior engineers using the same tools often ship faster too — but they ship more bugs, more security vulnerabilities, and more technical debt. They don't have the pattern recognition to spot when the AI generates code that works but is architecturally wrong — or, like the settings endpoint above, code that passes every test and still ships a hole.
The 3x Framework
The framework we use at Black Gibbon to get 3x throughput without 3x risk:
AI generates. The first draft of any feature, function, or module is AI-generated. This handles the boilerplate, the standard patterns, and the initial structure.
Humans review. Every AI-generated PR gets a human review focused on: security, error handling, performance implications, and architectural fit. This isn't a rubber stamp — our reviewers reject or significantly modify about 30% of AI output. The access-control bug in that settings endpoint is exactly what this step exists to catch.
AI tests. After human review, AI generates test cases — including edge cases the original generation missed. The human reviewer verifies test coverage and adds scenarios the AI didn't consider.
Humans decide. Architecture decisions, technology choices, data model design, and API contracts are human decisions. AI can propose options, but the judgment call stays with experienced engineers.
The Results
Across our client projects, this framework delivers:
- 3x faster feature development compared to fully manual coding
The future isn't AI replacing developers. It's AI amplifying the best developers. The companies that understand this will build better products, faster, with fewer defects.