Hacker News Reader

Comment by brightball | Hacker News Reader

I heard a talk from a VP at NVIDIA a couple of months ago and he echoed this. Essentially their policy is "you are still fully responsible for the code you ship, whether AI helps with it or not"

View on HN

While also no doubt telling C-level that the AI can write code completely automatically.

The developers in this scenario are there to absorb the blame when things go wrong. "Human crumple-zones" to protect the company.

this is a good policy, as long as the productivity expectations match it. The problem happens when you combine "you're responsible for what you ship" with "you need to be 100x faster"

Culpability is and always will be the limiting factor in AI adoption.

As humans, we need another human to blame when things go wrong.

Especially in situations that are catastrophic when things go wrong.

Does anyone out there working with AI coding agents not have this policy?

Not to be pedantic and apologies if this is what you meant but my experience has been enforcement of that policy being the problem.

Will be interesting to see if / when enforcement happens given management is currently being pushed to encourage AI use

Not at PocketOS. It's hard to believe they're the only ones.

Depends on what is meant by "fully responsible" I guess. At my company non-engineers push code to production where the only reviewer is frequently an LLM, if the code is broken they get an LLM to fix it. The human does not understand the code, they are not even trying to, this is pure vibe coding. We also have engineers who push code to production that they have not written, and not fully read, and has not been read by another human (at least not in detail).

I would say that counts as "not having that policy". Based on what management tells us, we are dead if we don't operate this way.

That is certifiably insane if that code touches anything that’s exposed to the internet or any PII. What kind of industries is those acceptable in?

I think being responsible for the code is a better framing. I run a saas and I don’t always review all the code, but this thing supports my family, so I am acutely aware that I’m responsible for what it does. My customers aren’t going to let me blame the agent for fucking up their workflows.

But that still doesn’t mean I review all the code. I tend to review defensively, based on the potential for harm if this piece of code is broken. And I rely a lot on tests, static analysis, canaries, analytics, health checks, etc. to reduce risk for when I’m wrong. So far it’s working.

Reply on news.ycombinator.com