Calibrated AI Use

Patterns beginner 10 min

Sources verified Dec 25, 2025

A framework for matching AI oversight levels to code stakes—using AI everywhere while calibrating verification to risk.

The question isn't whether to use AI for critical code—it's how much oversight to apply. Research shows AI-generated code has ~1.5-2.7x more security issues than human code. But human code has security issues too—the answer is calibrated oversight (security scanning + expert review), not blanket avoidance.

The Core Principle

The bottleneck is human review capacity, not AI capability.

An authentication expert can use AI for auth code—with appropriate oversight. A security engineer can use AI for security tooling—with proper review. Blanket prohibitions waste expertise and slow teams down.

Instead, match:

• Reviewer expertise → Code domain
• Review depth → Code stakes
• Tooling → Risk level

The Oversight Calibration Framework

Code Stakes	Examples	Oversight Level	What Changes
HIGH	Auth, crypto, compliance, financial	Maximum	Security scanning (SAST/DAST), domain expert review, mandatory test coverage, audit trail
MEDIUM	Business logic, data handling, APIs	Standard	Thorough code review, domain-aware reviewer, integration tests
LOW	Boilerplate, formatting, CRUD	Basic	Standard code review, unit tests, linting

The Research: CodeRabbit 2025 found AI code is 1.57x more likely to introduce security findings (2.74x for XSS, 1.88x for password handling). Veracode 2025 found 45% of unreviewed AI code failed security tests (controlled conditions; varies by language—Java 72%, Python 38%)—but human code also has vulnerabilities. Both need verification. The math favors calibrated oversight, not avoidance.

High-Stakes Code: Maximum Oversight

What qualifies: Authentication, authorization, cryptography, financial calculations, PHI/PII handling, compliance-critical code.

Oversight requirements:

1. Security scanning: Run SAST/DAST on ALL code (AI or human)
2. Domain expert review: Reviewer must have expertise in the specific domain
3. Mandatory test coverage: 100% branch coverage for security-critical paths
4. Audit trail: Document who reviewed what and when

Why not just avoid AI? Because human code also has bugs. Veracode's own data shows human code has security issues too—the 45% AI flaw rate is compared to a human baseline that's also non-zero. The solution is verification, not avoidance.

Medium-Stakes Code: Standard Oversight

What qualifies: Business logic, data transformations, API integrations, non-trivial CRUD operations.

Oversight requirements:

1. Thorough code review: Read and understand, don't just approve
2. Domain awareness: Reviewer should understand the business context
3. Integration tests: Verify behavior at system boundaries
4. Edge case coverage: AI often misses domain-specific edge cases

AI advantage here: AI excels at generating correct-looking code for well-defined patterns. The risk is subtle business logic errors, which domain-aware review catches.

Low-Stakes Code: Basic Oversight

What qualifies: Boilerplate, formatting, simple CRUD, test scaffolding, documentation.

Oversight requirements:

1. Standard code review: Quick sanity check
2. Unit tests: Verify basic correctness
3. Linting: Catch obvious issues automatically

AI advantage here: This is where AI delivers the most value with least risk. Boilerplate is tedious for humans but trivial for AI.

Context Matters for Productivity: METR 2025 found experienced developers were 19% slower with AI on their own familiar codebases. On unfamiliar code or greenfield projects, results may differ. Know your context—AI isn't universally faster.

Common Pitfalls

Pitfall	Problem	Better Approach
Blanket AI bans	Wastes expert capacity on low-stakes work	Calibrate oversight to stakes
Blanket AI trust	45% security flaw rate in AI code	Always verify, scale depth to stakes
Expertise mismatch	Reviewer lacks domain knowledge	Match reviewer expertise to code domain
No tooling for high-stakes	Manual review misses systematic issues	Add SAST/DAST for security-critical code

The Quick Decision

Before AI generates code, ask:

1. What's at stake if this code has bugs?

   • Security breach, compliance violation, data loss → HIGH stakes
   • Business logic errors, degraded UX → MEDIUM stakes
   • Cosmetic issues, slower development → LOW stakes

2. Do I have the right oversight for this stake level?

   • HIGH: Expert reviewer + security scanning available?
   • MEDIUM: Domain-aware reviewer available?
   • LOW: Basic review process in place?

3. If oversight is unavailable, reduce scope

   • Can't get expert review? Use AI for less critical parts only
   • No security scanning? Add it before touching auth code

Key Takeaways

• 45% of AI code fails security tests, but human code also has vulnerabilities—both need verification (Veracode 2025)
• AI code has 1.57x more security findings, up to 2.74x for XSS (CodeRabbit 2025)
• The bottleneck is review capacity, not AI capability
• Match oversight level to code stakes: maximum for auth/crypto, standard for business logic, basic for boilerplate
• Match reviewer expertise to code domain—an auth expert can use AI for auth code
• Always run security scanning on high-stakes code, regardless of who wrote it

Visual Overview

Fullscreen

Match Oversight to Stakes

Match Oversight to Stakes

In This Platform

This platform applies calibrated oversight: build-time validation (guardrails), schema enforcement (structured outputs), and source verification (human review of claims). The survey assessment itself helps teams identify their current oversight calibration.

Relevant Files:

• build.js
• Directoryschema/

  • …
• Directorysources/

  • …

Related Concepts

Understanding AI LimitationsGuardrailsTDD for AI Agents

Prerequisites

Understanding AI Limitations

Sources

✓ Veracode: 45% of AI code fails security tests; XSS defense failed in 86% of samples; Java had 72% failure rate ⓘ

×

October 2025 Update: GenAI Code Security Report

Veracode

Primary source for AI code security statistics: 45% overall failure rate, 72% for Java specifically. The 'bigger models ≠ more secure code' finding is critical for model_routing - security scanning is needed regardless of model. Java's 72% rate makes it the riskiest language for AI-generated code.

Key Findings:

• AI-generated code introduced risky security flaws in 45% of tests
• Java was the riskiest language with 72% security failure rate
• XSS (CWE-80) defense failed in 86% of relevant code samples

Credibility: high

Referenced by:

Calibrated Trust Vibe Coding Calibrated AI Use Guardrails Quick Reference: AI Code Checklists Debug a Hallucinating AI When AI Gives Garbage Output: A Systematic Troubleshooting Guide Vibe Coding Failures: When 'Accept All' Goes Wrong Security Review Workflow: AI-Assisted Code Auditing

View Source ↗

✓ CodeRabbit: AI code is 1.57x more likely to introduce security findings overall (2.74x for XSS, 1.88x for password handling) ⓘ

×

State of AI vs Human Code Generation Report

CodeRabbit

This is the most rigorous empirical comparison of AI vs human code quality to date. The 1.7x issue rate and specific vulnerability multipliers (2.74x XSS, 1.88x password handling) are critical for trust_calibration recommendations. Key insight: AI makes the same kinds of mistakes humans do, just more often at larger scale. The 8x I/O performance issue rate shows AI favors simple patterns over efficiency.

Key Findings:

• AI-generated PRs contain 1.7x more issues overall (10.83 vs 6.45 issues per PR)
• AI PRs show 1.4-1.7x more critical and major issues
• Logic and correctness issues 75% more common in AI PRs

Credibility: high

Referenced by:

Calibrated AI Use

View Source ↗

✓ METR: Experienced devs on familiar codebases were 19% slower with AI—context matters for productivity ⓘ

×

Measuring the Impact of Early-2025 AI on Experienced Open-Source Developer Productivity

METR

This is the most rigorous 2025 study on AI coding productivity. The RCT methodology (16 experienced developers, 246 tasks, $150/hr compensation) makes this highly credible. The 39-44 percentage point gap between perceived and actual productivity is the key insight for our trust_calibration dimension. This directly supports recommendations about not over-trusting AI suggestions and maintaining verification practices.

Key Findings:

• Experienced developers were 19% slower with AI
• Developers perceived 20% speedup (39-44 percentage point gap)
• Self-reported productivity may not reflect reality

Credibility: high

Referenced by:

Understanding AI Limitations Calibrated AI Use AI System Monitoring The AI Productivity Paradox Managing Review Fatigue: When AI Output Overwhelms Human Oversight When AI Gives Garbage Output: A Systematic Troubleshooting Guide Knowing When NOT to Ask AI: Preserving Core Skills Catching a Hallucination: Trust but Verify

View Source ↗

✓ Addy Osmani: Treat AI code like any external contribution—always review, scale depth to stakes ⓘ

×

The 'Trust, But Verify' Pattern For AI-Assisted Engineering

This article provides the conceptual framework for our trust_calibration dimension. The three principles (Blind Trust is Vulnerability, Copilot Not Autopilot, Human Accountability Remains) directly inform our survey questions. The emphasis on verification over speed aligns with METR findings. Practical guidance includes starting conservatively with AI on low-stakes tasks.

Key Findings:

• Blind trust in AI-generated code is a vulnerability
• AI tools function as 'Copilot, Not Autopilot'
• Human verification is the new development bottleneck

Credibility: high

Referenced by:

Calibrated AI Use When AI Gives Garbage Output: A Systematic Troubleshooting Guide Knowing When NOT to Ask AI: Preserving Core Skills Good vs Bad Context: A Side-by-Side Comparison Catching a Hallucination: Trust but Verify Security Review Workflow: AI-Assisted Code Auditing

View Source ↗

Oversight Levels

Stakes	Examples	Oversight Required
HIGH	Auth, crypto, compliance	Security scanning, domain expert review, 100% test coverage
MEDIUM	Business logic, APIs	Thorough code review, integration tests, edge cases
LOW	Boilerplate, CRUD	Standard review, unit tests, linting

The Key Insight

The question isn’t whether to use AI for critical code—it’s how much oversight to apply.

Finding	Source
AI code has 1.57x more security findings (2.74x for XSS)	CodeRabbit 2025
45% of AI code fails security tests; human code also has vulnerabilities	Veracode 2025

Both AI and human code need verification. The answer is calibrated oversight, not avoidance.