On October 13, TechHQ reported that Amazon and AWS are pulling back on AI-generated code — more caution, tighter internal rules, and, by the account of several write-ups, mandatory senior sign-off before AI-assisted changes ship. Eight months after AI-assisted changes were linked to retail outages and an internal meeting about “high blast radius” incidents, the largest cloud company on earth has concluded that the answer to machine-written software is a human signature.
That isn’t a control. It’s a receipt.
The Sign-Off Is a Confession
A sign-off is worth exactly what the signer read. Ask any senior engineer who has been handed forty diffs before lunch how much of each one they actually reconstruct. The form gets filled in; the comprehension doesn’t happen; the incident review afterward quotes the form.
The numbers from this year are not ambiguous. Faros’s telemetry, summarized in a widely circulated analysis, shows bugs per developer up 54% and production incidents per pull request up 242.7%. Median review time grew roughly fivefold, code churn about tenfold, and deployments per week fell 11.7%. DORA still finds a negative relationship between AI adoption and delivery stability, and Meta’s own internal ratio, per the same analysis, tells the same story from inside a single company.
Read those metrics again, because they all describe the same object: a queue. Incidents per pull request is a queue metric. Review time is a queue metric. Deployments per week is a queue metric. The industry’s response to a growing queue has been to install a checkpoint inside the queue — which is like fixing a traffic jam by requiring every driver to sign a form at the on-ramp.
Nobody’s Name Is on the Line
The Hacker News thread that prompted this column — “How to deal with shipping AI-written code you don’t understand?” — sat at 292 points with 436 comments. More comments than points. Nobody upvotes that question. They confess to it. Four hundred-odd people explaining, at length and with real distress, that they have shipped code they cannot reconstruct.
But the thread misdiagnoses itself. Comprehension is not the missing ingredient. Half those commenters could read the diff if they had an afternoon and a working staging environment. The thing they can’t find is an owner.
Compare it to a profession that solved this a century ago. A licensed civil engineer puts a stamp on a drawing, and that stamp means a named human’s livelihood is stapled to the load calculation. Not a committee. Not a second pair of eyes at the on-ramp. A person who cannot personally absorb the failure has no business certifying the design.
Software spent twenty years stripping out the institutional equivalents — the long-tenured staff engineer who owned a service, the on-call rotation with real teeth, the team that stayed together long enough to remember why the weird line was there. We replaced all of it with velocity dashboards and called the result a culture.
“We call it review,” a staff engineer at a payments processor wrote in a company Slack channel during a Tuesday afternoon rollback, “but mostly it’s triage.”
Blame is an engineering control. It is why on-call rotations function and why postmortems have names attached. A system in which nobody can be blamed is not a humane system; it’s an unmaintainable one, and the bill arrives as an outage at 3 a.m. in a rotation staffed by whoever is left.
Liability Is the Cheap Instrument
The industry’s reflex is more process. The political reflex on the right will be less regulation. Both skip the instrument that actually works, which is warranty exposure.
Right now the cost of an AI-introduced defect lands on the customer’s on-call rotation. Move it to the contract: a vendor shipping generated code into a critical path carries defect liability for it, the same as any component supplier whose part fails in the field. That is not a novel imposition. It is the oldest commercial arrangement we have, and it has the useful property of being priced rather than inspected. A vendor that eats the cost of its own defects will build the validation it keeps telling everyone else to build.
Conservatives will hear “new liability” and reach for the fainting couch. But this is the conservative instrument, properly understood: assign the cost to the party best positioned to prevent it and let the price carry the information. The alternative is what Amazon just did — an internal review ritual that runs at human speed, in a system where review time has already grown fivefold and throughput has gone backwards.
Here is the prediction, offered with the confidence of a man who has watched this movie before: within a year, the firms that advertise “every AI change is reviewed by a senior engineer” will post the worst incident records of their peer group. They are measuring the thing that is countable — signatures — instead of the thing that matters, which is whether anyone would be embarrassed to have their name on the line.
Amazon’s new rule is fine as far as it goes, and it will buy them a quieter quarter. But the first serious lawsuit over an AI-introduced defect in a system people depend on will not turn on whether the code was reviewed. It will turn on whether anyone was responsible.
Everything else is compliance theater with a linter.