Traditional workflow
Before generative AI assistance- 1
Clarify the goal using a pull request changing access controls
- 2
Read the diff and surrounding code
- 3
Check behavior and security assumptions
- 4
Discuss findings and approve or request changes
- 5
Check the result against the agreed criteria
- 6
Communicate the outcome and record the decision
AI-assisted workflow
AI contributes. You guide and verify.- 1
Define the goal, constraints, and permitted information
- 2
Provide relevant, sanitized context from a pull request changing access controls
- 3
Ask AI to flag suspicious changes and summarize the diff
AI + YOU - 4
Inspect suggestions against original evidence and domain rules
- 5
Revise the output and independently validate the result
YOU - 6
A responsible professional approves and communicates the outcome
Can a user gain access to another tenant through this change?
The shift: Reviewing, validating, and integrating AI-generated code. Foundational skills still matter.
A practical learning path for Software Engineering.
What changes — and what doesn’tSkills & responsibilities
Flag suspicious changes and summarize the diff. The output is a starting point to inspect, not a decision to accept automatically.
Validate correctness, choose tradeoffs, protect users, and approve changes.
FoundationsProgramming, algorithms, system design, and security.
AI collaborationProviding task-specific context and requesting explicit assumptions.
VerificationChecking a pull request changing access controls against independent evidence.
Professional skillsCommunicating tradeoffs and taking responsibility.
Where AI can go wrong3 things to check
A plausible but wrong answer
AI review may overlook an authorization boundary. It can fail the underlying goal even when it sounds convincing.
Your checkTest cross-tenant access and require the missing authorization check.
Missing or invented context
AI may fill gaps with unsupported assumptions, which can send the work in the wrong direction.
Your checkTrace claims to original evidence and ask the relevant person about unknowns.
Information shared in the wrong place
Sensitive records or code can cross confidentiality boundaries if supplied to an unsuitable tool.
Your checkUse approved tools, share the minimum context needed, and follow your organization’s rules.
Try a quick exerciseA practical scenario
A new lookup fetches a document by ID without checking its tenant.
Sources & contextEvidence behind this example
These are illustrative workflows, not claims that AI is always better or that every organization works this way. The scenarios and checkpoints are editorial teaching examples.
Reviewed September 2026 · Growing PracticeO*NET — Software DevelopersSupports the role and task baseline; it does not validate our AI workflow sequences.GitHub — Responsible use of inline suggestionsDocuments review and security responsibilities for generated code; capabilities vary by tool and configuration.GitHub — About Copilot code reviewEvidence of an available assisted-review capability, not proof of universal adoption or correctness.How we build these examples