An AI coding agent types faster than I do. There is no point arguing with that. But agents have one trait worth remembering: they are always confident. Confident when they renamed a field in one place out of three. Confident when they "fixed" a test by deleting the assertion. So the real question is not whether to use AI. It is what stops it.
On the platform I'm building (a B2C home-services product, name under NDA), the answer is tests, hooks and reviews. Here is how that works.
A test for every change
The rule is simple: a change without a test does not reach main. Not "nice to have" — required. The project now has more than 1,800 tests on node:test, from pricing functions to access rules.
It sounds like bureaucracy, but it works the other way around. When an agent proposes a change, I don't read every line with suspicion. I look at the test it added and ask whether that test failed before the change. A test that was green from the start proved nothing, and that's my cue to dig in.
Guard hooks
You can explain rules to an agent in words. It will even remember them — until the next long context. So the rules that matter most don't live in prose; they live in hooks that physically block the dangerous move:
- no editing a database migration that has already been applied — write a new one;
- no printing secrets to the output;
- no
git add -Aorcommit -a, so only intended files land in a commit.
A hook never gets tired and never agrees that "just this once is fine". For me, it's the main reason I can trust an agent at all.
Reviewer agents
Agent-written code goes through the same review as mine. On top of that, there are narrow reviewer agents: security, UX, SEO. Each looks at a change from one angle and ignores the rest.
The key detail: reviewers advise, I decide. A reviewer agent can find a problem that isn't there, just as confidently as an author agent writes one that is. Two confident agents don't add up to one correct answer, so the final word belongs to a human and the tests.
End-to-end, per role
Unit tests check pieces. Users don't use pieces; they walk a path. The project has 46 Playwright scenarios split by role: customer, specialist, operator. Each one walks its own path in a real browser.
That catches what pieces hide: the button exists, the API works, but an operator with one role sees something only another role should see.
CI on my own box
All of it runs in GitHub Actions on a self-hosted runner on a VPS. Branches, PRs, and only green goes to main. A self-hosted runner isn't about saving money; it's about control. The environment matches production, and I know exactly what's installed.
The takeaway
AI gave me the kind of speed that used to require a team. But speed without brakes isn't speed — it's a delayed crash. Tests, hooks and reviews are the brakes.
The formula I ended up with: the agent writes fast, the tests check honestly, and I own the result. If any of those three goes missing, stop. The model won't show up to the incident review. I will.