This one took me a second to frame properly.
Structure your answer as a repeatable review pipeline: treat AI output like an untrusted external contributor's PR, verify intent and correctness with tests and static analysis, then calibrate trust based on observed reliability. Emphasize that your process is risk-based—higher scrutiny for critical paths—and that trust is earned incrementally through measurable outcomes.
Pro tip: Frame AI as a 'junior engineer with perfect recall but no context'—you still own the merge. Mention that you track AI-assisted PRs separately (e.g., label or metric) to measure defect rates and adjust review depth, which shows you treat trust as an empirical, not emotional, decision.
Before reviewing code, clarify what problem the AI was asked to solve and whether the solution fits the codebase's architecture, conventions, and edge cases. Check for hallucinated APIs, outdated patterns, or assumptions that don't hold in your system.
Run the full suite of static analysis tools (linters, type checkers, security scanners, dependency checks) and treat any new warnings as blockers. AI often introduces subtle type errors or insecure patterns that static analysis catches cheaply.
Add or strengthen tests that specifically target the AI-generated logic: unit tests for edge cases, property-based tests for invariants, and integration tests for interactions. If the AI wrote tests, review them critically—they may be tautological or miss failure modes.
Read the diff line by line, focusing on security, performance, and maintainability. For high-risk areas (auth, payments, data deletion), require a second human reviewer or rewrite the code yourself.
Track outcomes of AI-assisted changes (e.g., bug rates, review comments) and adjust your process: start with heavy scrutiny, then relax for low-risk, repetitive tasks as evidence accumulates. Never fully automate merging without human sign-off.
AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.