What should happen when an AI code reviewer discovers an actionable issue?

What should happen when an AI code reviewer discovers an actionable issue?

An actionable review issue should enter a short resolution loop: confirm it, understand its impact, apply an appropriate fix, and verify the result. A review comment is a claim to investigate, not an automatic instruction to rewrite the feature.

Confirm the condition and consequence

Ask for the affected location, triggering conditions, and expected behavior. Reproduce the issue or trace the relevant code path. Check the requirement before changing behavior that may be intentional.

For example, a reviewer might report that a task-update endpoint accepts an identifier from another wedding without checking membership. Confirm whether the server's query and authorization logic actually allow that access, using controlled test accounts and data.

Apply the smallest complete correction

Fix the underlying rule at the appropriate boundary. Hiding the task-edit button is insufficient if the server still accepts unauthorized requests. Check other operations that share the same helper or access pattern so the correction remains consistent.

Add or update a focused regression test when it meaningfully protects against recurrence. Avoid broad refactoring unless it is necessary to resolve the issue safely or is separately justified.

Verify and close the finding with evidence

Run the relevant checks and repeat the reported scenario. For an authorization defect, verify both denial for the unauthorized user and continued success for an authorized organizer. Review the final diff for accidental scope expansion.

Record what changed and how it was verified. If investigation shows the report is mistaken, explain the existing behavior with concrete evidence. Clear resolution helps the engineer, reviewer, and QA session work from the same facts before the feature proceeds toward release.