Code verification & review

Note: review of generated code is not a substitute for execution containment (D11) — at any level here, review happens on code, while execution risk (an agent running a destructive command, say) is governed by D11's sandboxing and runtime controls. Strong review at D8 does not make unrestricted agent execution safe.

Code review used to scale roughly with headcount. AI-assisted generation breaks that assumption — the volume of code arriving for review can grow far faster than the number of humans available to read it carefully. This dimension measures whether review capacity actually scales with generation volume, or becomes the bottleneck, or gets quietly skipped under pressure.

Where most organizations start (Nascent)

Verification relies primarily on human line-by-line review of all generated code, regardless of risk or volume — meaning as generation speeds up, review either becomes a bottleneck or gets skipped. The first real step is placing deterministic automated gates (linters, static analysis, secret detection, basic CI) ahead of human review for everything, catching known-pattern issues without requiring contextual judgment.

Where the real gains happen (Modeled → Integral)

The meaningful shift is risk-tiering review itself: defining what makes a change high-risk (blast radius, data sensitivity, novelty, reversibility, security consequence) and letting routine, low-risk changes pass on automated gates alone, while concentrating human attention where it actually matters. The bigger gain beyond that is introducing an AI review layer that's structurally independent from whatever generated the code — reviewing in parallel across correctness, security, performance, and intent, with humans concentrating on what it flags as high-severity.

What the top of the curve actually looks like (Telemetric)

At full maturity, the review system itself is under continuous measurement — confirmed findings, dismissed findings, escaped defects, false positives and negatives, all tracked and used to recalibrate thresholds and tiering criteria. The independent reviewer's own effectiveness is treated as something to verify, not something to trust by default.

Why this dimension matters

An AI review layer that quietly repeats the generator's own blind spots isn't independent review — it's a second opinion from the same source. This dimension is what keeps the review system itself honest, not just the code it's reviewing.

---

Drafted from the SDLC model's real locked content — including the transition and verification notes now folded into ai_native_sdlc_maturity_model.md itself (2026-07-27). D8 carries no open review flag, though its boundary with D11 (reviewed above) is worth reading alongside it.