Summary
Architectural review is becoming the bottleneck in AI-assisted development because AI increases code output faster than reviewer capacity scales. While generation is accelerating, architectural validation remains constrained by human review bandwidth. This creates governance pressure that traditional review workflows were not designed to absorb. The solution is not faster review — it is moving governance checks earlier in the workflow, before code reaches human review at all.
The constraint in software development has moved. Not the bottleneck people are debating — velocity, quality, team size — but the structural constraint. The thing that, once saturated, determines how fast the whole system can move. For most engineering teams using AI coding assistants, it has quietly shifted from writing code to reviewing it. Most teams haven’t noticed yet, because the queue is still manageable. It won’t stay manageable.
The Speed Asymmetry
When AI coding assistants entered most engineering workflows, the headline story was productivity. Developers shipping faster. Features completing in hours rather than days. Junior engineers producing output that previously required senior involvement. That story is broadly true. Code generation has accelerated substantially.
What changed less visibly was the ratio. The ratio of code written to code meaningfully reviewed. AI writes at machine speed. Humans review at human speed. Those two rates are now decoupled in a way they never were when both sides of the equation depended on the same human cognitive throughput.
In the old model, the developer who wrote the code also experienced its constraints. They knew what they were trying to do, why they made each structural choice, and where the edges of the problem were. That implicit context transferred — imperfectly, but partially — into the review. The reviewer was scrutinising work that still bore the fingerprints of deliberate human intent.
AI-generated code does not carry that context. It carries the appearance of intent. The result is that reviewers are now being asked to reconstruct purpose from output — to determine not just whether the code is correct, but whether the model understood what was actually being asked of it. That is a harder, slower cognitive task. And the volume asking for that task is growing every sprint.
The Queue That Has Not Collapsed Yet
Most engineering teams reading this will feel relatively fine. PRs are getting reviewed. Nothing is acutely on fire. The backlog is manageable. This is precisely the moment to pay attention, because what looks like stability is a leading indicator in disguise.
The volume of AI-generated code is compounding. As developers grow more comfortable with AI tools, as the tools themselves improve, as organisations push for higher output — the generation rate increases. Review throughput is roughly flat. It is bounded by the number of engineers who can perform meaningful architectural review, the time they have available for it, and the cognitive load of the work itself. That upper bound has not grown in step with generation volume, and there is no technical reason it would.
Review throughput does not scale linearly with AI-generated code volume.
The mathematics is simple. At some point — sooner for fast-moving teams, later for more conservative ones — the queue backs up. Review becomes the drag. And at that point, the temptation is to review faster, which means reviewing shallower.
The more insidious version of this problem does not announce itself as a backed-up queue. It arrives as a particular kind of PR: one that looks clean on the surface but contains architectural decisions baked invisibly into implementation choices. A dependency introduced without formal approval because the LLM defaulted to it and nobody caught the import. A pattern adopted because it was statistically common in the model’s training data, not because the team chose it. A module structured in a way that quietly violates a decision made three months ago about separation of concerns.
These do not fail tests. They accumulate as drift.
Why AI-Generated Code Is Harder to Review, Not Easier
There is a widespread assumption in engineering teams that AI-generated code is essentially boilerplate — idiomatic, conventional, safe to skim. That assumption is producing a specific category of failure.
The problem is that LLMs produce syntactically confident code. It looks deliberate. It is formatted correctly, follows common conventions, passes linting without protest. The signal that something is wrong is almost never a syntax error or a failing test. It is something subtler: an architectural assumption embedded in an implementation choice, invisible to automated checks and easy to miss in a review focused on surface correctness.
Consider what a reviewer must now actually determine when looking at an AI-generated PR. Not just: does this code do what the ticket says? But: did the model understand the constraint that governs this area of the codebase? Did it comply with the architectural decision recorded six months ago, or did it happen to produce something that doesn’t obviously violate it? Is this pattern intentional, or is it what the model reaches for by default when it has no contrary guidance?
Architectural drift occurs before code reaches pull request review.
Judging intent from output is harder than judging correctness from output. A human reviewer can ask the human who wrote the code. They cannot ask the model what it understood.
The specific failure mode worth naming here is the violation that passes everything automated. It passes CI. It passes linting. It passes a review focused on whether the feature works. And it violates an architectural decision — one made deliberately, for good reasons, documented somewhere — because that decision was never surfaced to the model, was never machine-enforceable, and was not front-of-mind for the reviewer during a busy sprint. The damage is invisible until it compounds.
The Governance Gap
The problem is not that developers are careless. Engineering teams using AI tools are generally thoughtful people trying to move quickly under real constraints. The problem is structural: the toolchain has no layer between “AI generates code” and “human reviews code.” There is no point in the workflow at which architectural decisions are enforced at generation time. There is no check that asks, before the PR is opened, whether the output is consistent with the decisions the team has already made.
Constraints live in Confluence pages last updated by someone who has since left. They live in Slack threads unsearchable by the time they matter. They live in the heads of senior engineers who joined the project early enough to remember why certain choices were made. They are not injected into the model’s context. They are not machine-readable. They cannot act on code.
A decision that can be ignored isn’t a decision. It’s a suggestion.
Prompt engineering cannot enforce architectural constraints consistently across a team generating code at scale.
Architecture Decision Records were a genuine improvement on what came before them. They created a structured, version-controlled format for capturing the reasoning behind major architectural choices — making decisions visible and auditable in a way that Slack threads never were. But they were designed as human-readable documentation, to be consulted by human engineers making human decisions. They were not designed to be machine-enforceable. They cannot intercept an AI-generated PR that violates their contents. They can only be read after the fact, if someone thinks to look.
The governance gap is the distance between where architectural decisions are stored and where code is generated. That distance has always existed. AI-assisted development has made it consequential in a way it was not before, because the generation rate is now high enough for the gap to produce consistent, compounding drift rather than occasional human error.
Shift-Left Governance as the Frame
The software industry has encountered this structural problem before, in different forms, and has solved it through the same mechanism each time: moving the constraint check earlier in the workflow.
Testing moved left. QA at the end of a release cycle gave way to unit tests at development time, which gave way to test-driven development, which gave way to pre-commit hooks that refuse to let untested code leave the machine. Security scanning moved left — from periodic penetration tests to static analysis integrated into the IDE. Linting moved left. Code style enforcement, which once required human reviewers to manually flag formatting inconsistencies, is now automated before code is committed.
The pattern is consistent: find the violation as early as possible, as close to the point of generation as possible. The further downstream a violation is caught, the more expensive it is to fix, and the more likely it is to have already influenced decisions built on top of it.
Architectural governance needs to move left in exactly the same way. Not post-review. Pre-generation — or at minimum, pre-PR. The appropriate moment to check whether AI-generated code is consistent with an architectural decision is before that code is submitted for human review, not during it. If the constraint can be expressed in a machine-readable form, it can be checked automatically. Human review can then be focused on the decisions that genuinely require human judgement — the novel cases, the trade-offs that need contextual reasoning, the edge cases no automated check would catch.
This is not an argument for removing human review from the loop. It is an argument for preserving the value of human review by ensuring it is not consumed by catching drift that a machine could have flagged.
What This Means for Engineering Teams
There are three diagnostic questions that engineering leads should be able to answer about their current workflow. Most cannot answer all three.
Where do your architectural decisions actually live? Not in principle — in practice. Are they in a format that a tool could read and act on? Are they co-located with the codebase they govern, version-controlled, and current? Or are they distributed across documentation systems disconnected from the development workflow?
What percentage of AI-generated PRs are reviewed at architectural depth? Surface correctness review — does the code do what the ticket says, does it pass tests, is it readable — is not the same as architectural review. In a high-generation-volume environment, the two are getting conflated under time pressure. Knowing which category most reviews fall into is useful information.
Is review throughput keeping pace with generation volume? This is the leading indicator. If generation volume has grown significantly over the past six months and review throughput has not, the queue pressure is building even if it is not yet visible as delay. The maths will eventually assert itself.
LLMs forget. Projects do not. The decisions a team has made — about architecture, about dependencies, about patterns — accumulate in the codebase as institutional memory. When the tools generating new code have no access to that memory, every generation is effectively a fresh start. The friction of re-establishing context, re-catching violations, re-explaining constraints is distributed invisibly across the review process, where it is experienced as slowness rather than recognised as a structural problem.
The Bottleneck Has Shifted
Code generation is no longer the constraint in AI-assisted development. For teams that have adopted these tools seriously, the constraint is now architectural review — the human capacity to examine generated output not just for correctness but for fit with an existing set of deliberate decisions.
Teams that recognise this early will adapt their toolchain accordingly: moving governance checks earlier in the workflow, making architectural decisions machine-readable, and ensuring that human review is concentrated on the work that actually requires human judgement. Teams that do not will experience it as friction — PRs taking progressively longer, review fatigue setting in, architectural drift accumulating quietly across a codebase — and will misattribute it to process problems rather than toolchain gaps.
Architectural governance is the next engineering discipline to be formalised for the AI-assisted context. The question is not whether that formalisation will happen, but whether teams will arrive at it proactively or be pushed there by the accumulated cost of not having done so earlier.
Key Takeaways
- Architectural review — not code generation — is now the binding constraint in AI-assisted development teams.
- AI output scales faster than human review capacity. The gap compounds with every sprint.
- AI-generated code is harder to review than human-written code because reviewers must reconstruct intent from output, not just verify correctness.
- Architectural drift accumulates through violations that pass tests, pass linting, and pass surface-level review.
- Governance must shift left: constraints need to be enforced at generation time, not caught during review.
- Pre-generation constraint enforcement preserves the value of human review by concentrating it on genuinely novel decisions.
FAQ
- Why is AI-generated code harder to review?
- It carries the appearance of deliberate intent without the underlying context. Reviewers must determine whether the model understood the architectural constraints governing the codebase — a harder task than verifying whether a human developer followed them.
- Why doesn’t prompt engineering solve governance?
- Prompt-level constraints are not version-controlled, not enforced across sessions, and degrade as context windows fill. They rely on the model consistently applying guidance it may have been given days or sprints ago. That is not a governance layer — it is a suggestion.
- What is shift-left AI governance?
- Moving architectural constraint enforcement earlier in the workflow — ideally to generation time, at minimum to pre-PR. The same pattern as testing, security scanning, and linting: catch violations when they are cheapest to fix, not after they have influenced decisions built on top of them.
- What does a machine-readable architectural decision look like?
- A structured record — YAML, JSON, or similar — stored in version control alongside the codebase it governs, with enough specificity that a tool can evaluate whether generated code violates it. Not a prose document in Confluence.