Earlier quoted context omitted.
What type of software are you building with this workflow? Does it handle PII, need data to be exact, or have any security implications? Because I might just not have a great imagination, but it's very hard for me to see how you basically automate the review process on anything that is business critical or has legal risks.
Mainly working on a dev tool / SaaS app right now. The PII is user names & email. On the security layer, I wrote that code mostly by hand, with some 'pair programming' with Claude to get the Oauth handling working. When I have the agent working on tasks independently, it's usually working on feature-specific business logic in the API and frontend. For that work it has a lot of standard helper functions to read/write…
I think where I've become very hesitant is a lot of the programs that I touch has customer data belonging to clients with pretty hard-nosed legal teams. So it's quite difficult for me to imagine not reviewing the production code by hand.