Software is built, but before it “ships” to a point of live production, the software engineering team (almost instinctively) initiates a set of peer review and code review processes, which are designed to weed out integrity and defects, and ensure functionality and performance. With agentic code agents now creating massive codebases, line-by-line manual checks create an impossible bottleneck. Techzine Global spoke to a selection of software practitioners to assess how code review is changing and ask whether human-in-the-loop developers should now elevate themselves to concentrate on auditing high-level architecture and critical security boundaries.
Shreyas Satyanarayana, senior director of software engineering at Black Duck says that code reviews are multifaceted – and that while maintainability is certainly one important purpose, code reviews also serve as a mechanism for defence in depth and embody the shift-left philosophy in testing.
“Code reviews are typically conducted by team members who are subject matter experts on the repository, and they provide multiple value propositions,” said Satyanarayana. “Maintainability and conformance to established coding guidelines and design principles. Catching low-hanging bugs and flaws, not with the expectation of finding all issues, but to reduce the cost of fixing defects by identifying them early in the development cycle
Agentic code review considerations
In the era of AI, Satyanarayana reminds us that code reviews are evolving rapidly. It is now increasingly feasible to deploy agents that use automated tools to improve maintainability, enforce linting rules, and check for common issues.
“It will be interesting to see how the role of manual code reviews progresses as these capabilities mature; perhaps shifting human reviewers toward higher-level concerns like architectural decisions, domain logic validation, and knowledge transfer,” added Satyanarayana.
Greg Law, co-founder and CEO of Undo is also vocal on this subject. Undo provides what has been called “time-travel debugging technology” for programmers and AI coding agents with runtime context to diagnose complex software failures. Law thinks that code review has just been turned on its head right now.
Writing code is not the bottleneck
“Writing code is not the bottleneck,” asserted Law. “Actually, it never was, but it’s even less so now. But review has become a key bottleneck. It’s so hard for a human to review large diffs; you just sort of glaze over.”
NOTE: By way of definition, diffs (as referenced above) are visual line-by-line comparisons that developers use to point to where additions and deletions between code versions have happened; programmers (traditionally at least) have always had to manually check to verify changes highlighted in diffs before final merging.
“So today there is no alternative,” said Law. “Because review of AI-generated code is all about accountability. An AI cannot be accountable; only a human can. And if you don’t understand the code, you’re shirking your responsibilities. Today’s AIs are good at writing quality code – though neither AI nor humans write bug-free code. There are some nice AI tools to help with review, but they cannot do it for you, because they cannot take the accountability.”
Cryptographic verification & immutable ledger databases
Moshe Bar is cofounder and CEO Codenotary, a company known for its ability to protect software supply chains through cryptographic verification and use of immutable ledger databases to create tamper-proof software bill of materials (SBOM) management.
“Modern LLMs like Kimi are remarkably good at finding software defects. In our experience, around half of the bugs they uncover would challenge even highly skilled engineers, especially under realistic time constraints,” said Bar.
He notes that his team always remind themselves that we know from Turing, Rice and decades of computer science that no tool can prove arbitrary software is bug-free.
“But that’s not the point. The goal is to find more bugs, faster, and today’s best LLMs are already outperforming many traditional review processes. For many organizations, having an advanced AI examine code is a far better safety net than asking developers to find every flaw in their own work,” said Bar.
When AI becomes a commodity, eventually
Drew Streib, is VP of data engineering at Black Duck. He says that the discussion shouldn’t be whether AI belongs in code review; it clearly does.
“The real question is how to use it effectively,” explained Streib. “As AI becomes a commodity capability across development toolchains, organisations must recognise its limitations and embrace layered review strategies that combine automation, human expertise, and security controls to achieve meaningful coverage.”
It seems like code review has to now evolve, especially in an era when agents can now lay down a dependency tree with a vulnerable transitive component or a license conflict that no human would detect. The software supply chain is growing deeper and more opaque, so we need to think about sharpening and widening the code review toolkit.