Review stopped being the only guardrail (external link)
The framing in this paper is useful and the evidence under it is five people. Both halves matter, so let me do them in that order.
The observation is one most of us have made badly: guardrails — code review, linting, tests, CI — were sized for a world where a human wrote every line, and high-throughput generation strains them all at once. What the authors describe, from interviews situated inside a broader practitioner survey, is not teams tightening review but teams redistributing supervision across three layers:
Preventive — externalising architectural intent and conventions into machine-interpretable form. This is the rules file, the conventions doc, the committed agent definition. Supervision moved before generation.
Executable — linting, testing and CI/CD "repurposed as scalable supervision infrastructure." Same tools, different job: they are no longer catching your mistakes, they are the only reviewer that scales with volume.
Human oversight — shifting from line-by-line inspection toward supervisory interpretation: architectural reasoning, explainability, long-term maintainability.
They call the endpoint layered supervision, in which no single guardrail carries the load alone. As vocabulary I think that is right, and better than what we have been using. "Review does not scale" is a complaint. This is a description of what people replace it with, and the three layers are separable enough to audit yourself against on a Tuesday afternoon.
The evidence is five practitioners. That is a qualitative study doing what qualitative studies are for — generating structure, not measuring prevalence — and the authors present it as such. But this is going to get cited as a finding about how organisations are adapting, by people who read the abstract, and five interviews cannot support that sentence. Nothing here tells you how common layered supervision is, whether it works, or whether the teams doing it ship fewer defects. It tells you the shape exists and gives you words for it.
The part I am least comfortable with is the third layer, and it is not the paper's fault. "Supervisory interpretation focused on architectural reasoning" is what the good version looks like. The failure mode wears identical clothes: an engineer who has stopped reading diffs, describing themselves as focused on the architecture. I have caught myself in the second one and reported it as the first. Layers one and two leave artifacts — a committed rules file, a pipeline that either ran or did not. Layer three leaves nothing you can grep for, which is precisely why it is the one that quietly empties out.
Read alongside the RAMP paper, submitted to arXiv the same day by a different group, this gets more interesting than either alone. RAMP scores exactly the preventive layer described here, across 441 repositories, and finds teams that build it have half the cognitive-complexity growth. One paper names the mechanism from five interviews; the other measures a correlate of it at scale. Neither establishes causation and together they are still not evidence. But it is the first time I have seen the qualitative and quantitative halves of this argument point at the same artifact — a few pages of committed markdown — from opposite directions.
Which does not retire the middle sentence of everything I write here. Review is still the new writing. It is just no longer the only thing holding the door.