AI-Generated Code, Engineer-Owned: The Ownership Layer

HOW OWNERSHIP WORKS

Four Steps Between an AI Draft and Production

The 2026 question is not whether AI can write code — it is who answers for that code. Our AI-enhanced development teams run every AI draft through the same four steps.

Step 1

Review

Every AI-drafted change is read line by line by the engineer who owns it: architecture, correctness, and intent — not just 'does it compile'.

Step 2

Test

The engineer writes and maintains the tests that prove the change works: edge cases, failure modes, and regressions AI drafts routinely skip.

Step 3

Secure

AI output is checked against security fundamentals: injection, secrets handling, authentication, and safe defaults, before it ships.

Step 4

Own

One named engineer stays accountable for every line in production. When something breaks at 2am, ownership is not a committee.

AI DRAFTED IT. OUR ENGINEER CAUGHT IT.

What the Ownership Layer Catches

Representative examples, anonymised from real delivery patterns. Filter by discipline — the same six areas every GBF engineer is screened on before placement.

SecurityNode.js

A payment webhook handler

AI draft

−app.post("/webhooks/payments", async (req, res) => {
−  const signature = req.headers["x-signature"];
−  const expected = crypto
−    .createHmac("sha256", process.env.WEBHOOK_SECRET)
−    .update(JSON.stringify(req.body))
−    .digest("hex");
· 
−  if (signature === expected) {
−    await fulfillOrder(req.body.data);
·  }
−  res.sendStatus(200);
−});

Engineer's fix

+app.post(
+  "/webhooks/payments",
+  express.raw({ type: "application/json" }),
+  async (req, res) => {
+    const signature = Buffer.from(req.headers["x-signature"] ?? "", "hex");
+    const expected = crypto
+      .createHmac("sha256", process.env.WEBHOOK_SECRET)
+      .update(req.body) // raw bytes, not re-serialized JSON
+      .digest();
· 
+    if (
+      signature.length !== expected.length ||
+      !crypto.timingSafeEqual(signature, expected)
+    ) {
+      return res.sendStatus(401);
+    }
+    await fulfillOrder(JSON.parse(req.body).data);
+    res.sendStatus(200);
·  }
+);

What our engineer caught

The AI verified the signature against re-serialized JSON (which breaks when key order changes) and compared it with ===, which leaks timing information. It also answered 200 even when verification failed.

Why it matters

A forged webhook could confirm orders that were never paid. Raw-body verification and a timing-safe comparison are the difference between an integration and a fraud vector.

CorrectnessPython

An invoice total calculation

AI draft

−def invoice_total(lines, tax_rate=0.21):
−    subtotal = sum(l["qty"] * l["unit_price"] for l in lines)
−    tax = subtotal * tax_rate
−    return round(subtotal + tax, 2)

Engineer's fix

+from decimal import Decimal, ROUND_HALF_UP
+ 
+CENT = Decimal("0.01")
+ 
+def invoice_total(lines, tax_rate=Decimal("0.21")):
+    subtotal = sum(
+        Decimal(str(l["qty"])) * Decimal(str(l["unit_price"]))
+        for l in lines
+    )
+    tax = (subtotal * tax_rate).quantize(CENT, ROUND_HALF_UP)
+    return subtotal.quantize(CENT, ROUND_HALF_UP) + tax

What our engineer caught

Binary floating point used for money, and Python's round() applies banker's rounding — neither behaves the way finance teams and tax authorities expect.

Why it matters

Cent-level discrepancies multiplied across thousands of invoices fail reconciliation and audits, and erode customer trust one support ticket at a time.

Quality & TestingReact

Tests for an order-list component

AI draft

−jest.mock("./useOrders", () => ({
−  useOrders: () => ({ orders: [{ id: 1 }], loading: false }),
−}));
· 
−test("renders orders", () => {
·  render(<OrderList />);
−  expect(screen.getByRole("list")).toBeInTheDocument();
·});

Engineer's fix

+test("renders orders from the API", async () => {
+  server.use(ordersHandler([{ id: 1, status: "shipped" }]));
+  render(<OrderList />);
+  expect(await screen.findByText(/shipped/i)).toBeInTheDocument();
+});
· 
+test("shows empty state when there are no orders", async () => {
+  server.use(ordersHandler([]));
·  render(<OrderList />);
+  expect(await screen.findByText(/no orders yet/i)).toBeInTheDocument();
·});
+ 
+test("surfaces API errors to the user", async () => {
+  server.use(ordersFailure(500));
+  render(<OrderList />);
+  expect(await screen.findByRole("alert")).toBeInTheDocument();
+});

What our engineer caught

The AI mocked the very hook the component depends on, so the test asserted the mock — not the component. Empty, loading, and error states were never exercised.

Why it matters

Green tests that cannot fail are worse than no tests: regressions ship to production with a passing badge on them.

Architecture.NET

A customer summary endpoint

AI draft

·[HttpGet("customers/{id}/summary")]
·public async Task<IActionResult> GetSummary(int id)
·{
−    var customer = await _db.Customers.FindAsync(id);
−    var orders = _db.Orders.Where(o => o.CustomerId == id).ToList();
−    foreach (var order in orders)
−    {
−        order.Lines = _db.OrderLines
−            .Where(l => l.OrderId == order.Id).ToList();
−    }
−    return Ok(new { customer, orders });
·}

Engineer's fix

·[HttpGet("customers/{id}/summary")]
·public async Task<IActionResult> GetSummary(int id)
·{
+    var summary = await _customerService.GetSummaryAsync(id);
+    return summary is null ? NotFound() : Ok(summary);
·}
+ 
+// CustomerService — one query, projected to a DTO
+public async Task<CustomerSummaryDto?> GetSummaryAsync(int id) =>
+    await _db.Customers
+        .Where(c => c.Id == id)
+        .Select(c => new CustomerSummaryDto(
+            c.Name,
+            c.Orders.Select(o => new OrderDto(o.Id, o.Lines.Count))))
+        .SingleOrDefaultAsync();

What our engineer caught

Business logic and data access welded into the controller, a synchronous N+1 query loop, and full database entities serialized straight into the API response.

Why it matters

The endpoint gets slower with every order a customer places, and entity leakage couples your public API contract to your database schema — expensive to unwind later.

PerformanceTypeScript

A dashboard query for recently active users

AI draft

·async function recentActiveUsers() {
−  const users = await db.query("SELECT * FROM users");
−  return users
−    .filter((u) => u.status === "active")
−    .filter((u) => u.last_seen > Date.now() - 30 * DAY)
−    .sort((a, b) => b.last_seen - a.last_seen)
−    .slice(0, 50);
·}

Engineer's fix

·async function recentActiveUsers() {
+  return db.query(
+    `SELECT id, name, email, last_seen
+       FROM users
+      WHERE status = 'active'
+        AND last_seen > now() - interval '30 days'
+      ORDER BY last_seen DESC
+      LIMIT 50`
+  );
+  // supported by: CREATE INDEX idx_users_active_seen
+  //   ON users (status, last_seen DESC);
·}

What our engineer caught

The AI pulled the entire users table into application memory to keep 50 rows. Filtering, sorting and limiting belong in the database, backed by an index.

Why it matters

This works in the demo and falls over in production: at a million users it becomes an out-of-memory crash on your busiest endpoint.

DevOpsDocker

A production Dockerfile for a Node.js service

AI draft

−FROM node:20
·WORKDIR /app
·COPY . .
−ARG NPM_TOKEN
−RUN echo "//registry.npmjs.org/:_authToken=${NPM_TOKEN}" > .npmrc \
−    && npm install
−CMD ["npm", "start"]

Engineer's fix

+FROM node:20-alpine AS build
·WORKDIR /app
+COPY package*.json ./
+RUN --mount=type=secret,id=npmrc,target=/root/.npmrc \
+    npm ci --omit=dev
·COPY . .
+ 
+FROM node:20-alpine
+WORKDIR /app
+COPY --from=build /app /app
+USER node
+CMD ["node", "server.js"]

What our engineer caught

The registry token was written into an image layer — deleting the file later does not remove it from layer history. The container also ran as root with the full build context copied in.

Why it matters

Anyone who can pull the image can extract the credential. Leaked registry tokens are a textbook supply-chain entry point.

SecurityReact

Rendering user comments with formatting

AI draft

·function CommentBody({ comment }) {
−  // render formatted comment text
·  return (
·    <div
·      className="comment"
−      dangerouslySetInnerHTML={{ __html: comment.body }}
·    />
·  );
·}

Engineer's fix

+import DOMPurify from "dompurify";
+ 
+const SAFE = {
+  ALLOWED_TAGS: ["b", "i", "em", "strong", "a", "p", "ul", "li"],
+  ALLOWED_ATTR: ["href"],
+};
+ 
·function CommentBody({ comment }) {
+  const safeHtml = DOMPurify.sanitize(comment.body, SAFE);
·  return (
·    <div
·      className="comment"
+      dangerouslySetInnerHTML={{ __html: safeHtml }}
·    />
·  );
·}

What our engineer caught

User-supplied HTML rendered straight into the DOM — a stored XSS vulnerability. Any commenter could run script in every visitor's browser.

Why it matters

Stored XSS is session hijacking at scale: one malicious comment can compromise every user who views the page.

Wondering whether you still need developers at all? Read: Do you still need developers when AI writes the code? Or see how we deploy a fully managed team in 2–3 weeks.

AI-Era Engineering, Answered

The questions US, European and Australian buyers ask us about AI-generated code and ownership.

A.Yes — but their job has changed. AI now produces the majority of production code; the engineer's role is to direct it, then review, test, secure, and own the result. As AI generates more of the code, that review and accountability become the product. Every example on this page shows what happens when that layer is missing.

A.They are drawn from the kinds of issues our engineers catch in real AI-assisted delivery work, then anonymised and genericised: no client names, proprietary logic, secrets, or identifying details ever appear. Where needed, we reconstruct a representative version rather than expose real client code.

A.Every GBF engineer is screened across 6 competency areas before placement: technical fundamentals, AI development skills, architecture and design, quality and testing, DevOps and delivery, and communication. That screening is what qualifies them to own AI output: they review every change, test it, check it for security issues, and stay accountable for it in production.

A.Not when a qualified human owns the output — it means more rigour, not less. AI accelerates the drafting; the engineer's review, testing and security checks are where quality is decided. We never run a 'no humans needed' model: a screened engineer owns every line the AI produces.

Get AI Velocity With a Named Owner Behind It

A dedicated, AI-equipped engineer who owns every line — fully managed by us, ready in 2–3 weeks.

Get matched with developers within 4 hours
No upfront commitment
Fully managed setup

Start your team

Estimate your cost first? Calculate savings

Extend my team

Build my product

Fill a specific need

Hand over delivery

Enterprise

Engineering Pods

AI Writes the Code. Our Engineers Own It.

Four Steps Between an AI Draft and Production

Review

Test

Secure

Own

What the Ownership Layer Catches

A payment webhook handler

An invoice total calculation

Tests for an order-list component

A customer summary endpoint

A dashboard query for recently active users

A production Dockerfile for a Node.js service

Rendering user comments with formatting

AI-Era Engineering, Answered

Get AI Velocity With a Named Owner Behind It