No one reads the code

This has been in the back of my head, and someone on Lenny's podcast put it nicely. Companies are now making a policy of "no one writes code". Soon there will also be a policy of "no one reads the code".

StrongDM already do this, and they're a security access management product. They have a swarm of simulated employees doing the testing.

It reminds me of the devops rule that no one can click-ops infrastructure. When you can't click-ops, people ask "how can I remove this click-ops step?". It'll be the same here: "how do I remove this problem that requires a manual review?". And just like with devops, you get the benefit just by moving in that direction, and it's an even bigger unlock once you're 100% in.

I'm not saying everyone should immediately do this. NASA may need a few more manual reviews. It'll take a lot of work on the platform and a lot more guardrails, and I'm not there yet with my production code base. I could be totally wrong, I'm just pulling on this thread to see where it breaks.

---

I also think what we review might end up being much shorter than the code. You'd ask an LLM "tell me what happens in this scenario, how is this invariant enforced?" and it returns 10 lines of something Python-looking, in place of the 1,000 lines of Rust underneath.