Build an AI pre-production bug workflow as a sequence of release gates, not one final “review this code” prompt. The purpose is to catch specific escape paths while the change is still isolated, understandable, and cheap to repair.
Use five stages:
- Before coding: Ask the agent to map affected behavior, dependencies, permissions, data changes, and likely failure modes.
- During implementation: Convert acceptance criteria into normal, boundary, invalid, permission-denied, and concurrency tests.
- At diff review: Check interface contracts, migrations, configuration, feature flags, and unrelated edits.
- Before release: Run the actual build, static checks, integration tests, and a small smoke path in the target-like environment.
- After incidents: Turn every escaped defect into a permanent regression test or release check.
Require evidence for each gate: command, result, relevant file, and unresolved risk. A confident summary is not evidence. Keep changes small enough that a human can understand the diff, and do not let the same agent both define all acceptance criteria and declare itself successful without an independent check.
Start with the last three bugs that reached production. Identify where each could have been rejected earlier, then automate those checks. This page answers how to operate the workflow; the broader question of whether AI can find bugs depends on codebase context, test quality, and the agent's available tools.
Related reading: How to validate AI-generated code and How to review AI-generated code before merging.
