Beyond cheap code: Engineering challenges and the need for verification

A conversation worth having out loud

Sonar just launched a podcast, The Next Commit, hosted by Tom Howlett. The podcast kicks off a series of conversations with real-world engineers about how they are actually building software with AI right now.

The first guest, Ian Johnson, ships six to eight reviewable tickets a day. There is no heroic prompt or magic model behind it, just thoughtful engineering applied to the system that produces the software.

The truth is, Ian’s hard-won practices track with what we see across thousands of enterprise codebases. He arrived at the same conclusions from the workbench that we arrived at from the data.

How does AI change the role of software engineers?

Ian's central observation reframes the whole AI conversation: AI agents move engineering rather than removing it.

As coding got cheap, the work of defining outcomes, decomposing tickets, setting standards, and verifying results became more critical. His team rarely touches code, yet does more software engineering than ever.

This is the tension every engineering organization is living through. When code generation becomes abundant, the bottleneck moves downstream to verification. The gap between what agents produce by default and what your software actually requires is where risk accumulates.

The amplification thesis, from the trenches

Ian introduced the idea that an agent amplifies whatever it is directed toward—a concept he calls "the amplification thesis." In short, here's what you can expect from your AI agents:

• Point it at small, releasable changes, a truthful set of standards, and strong verification, and it amplifies discipline.
• Point it at vague work, a contradictory codebase, and weak feedback, and it amplifies confusion and debt, faster.

An AI agent enforces whatever standards you have already encoded, at machine speed and machine scale. That is precisely why the standard has to be independent of the agent, and why verification cannot be optional.

Ian describes this with what he calls a charter: the project's explicit standards, patterns, and constraints, delivered to the agent before it writes. He pairs it with hooks, tests, static analysis, security review, and architectural checks that reject any output falling outside an acceptable band.

Ian’s amplification thesis lands hard: a hook is more powerful than a rule. Guidance shapes intent while verification produces the evidence. You need both, and they have to work as one loop.

What is cognitive surrender and why is it detrimental for AI code review?

Ian's advice to junior engineers was blunt: resist cognitive surrender. Do not approve changes you do not understand simply because the agent sounds confident.

Shaw and Nave (Wharton, 2026) draw the line between cognitive offloading (delegating some reasoning to a tool that helps you think) and cognitive surrender, the uncritical abdication of reasoning itself.

Their trials measured what people actually do:

• Participants followed AI advice 92.7% of the time when it was correct.
• They followed it 79.8% of the time when it was wrong.

Confident, fluent output invites people to stop reading. This is almost certainly already happening in your code reviews, where an agent’s pull requests arrive far larger and far more often than human ones. Human review has to be revisited for the speed and volume of agent-generated code, backed by automated, independent code verification that scales where hand review cannot.

What is comprehension debt and how does AI-generated code create it?

Ian named a second cost that data alone rarely captures: comprehension debt. It builds when changes enter a system faster than the people accountable for it can understand them.

The bill comes due at 3 a.m., when someone gets paged and discovers the apparent speed was borrowed against their ability to diagnose the system.

This is the operational face of a pattern we see repeatedly. Carnegie Mellon researchers measuring code quality with SonarQube found a temporary 3-5x velocity spike in the first month of AI adoption that disappeared within three months, replaced by a persistent 30% rise in issues and a 41% rise in complexity. That debt is the silent tax on momentum—borrowed speed, repaid with interest.

Ian's best practices to keep in mind:

• Code quality matters more when code is cheap. The repository is part of the context the agent imitates, so today's structure becomes an input into tomorrow's change. Weak structure survives cheaper generation and lets debt accumulate faster.
• Humans still own the consequences. Your team, not the model, answers the customer and responds to the incident. Place people deliberately where judgment matters, and let automated, independent verification absorb the volume.

What this means for your loop

Ian built his control system by hand, tool by tool. Most enterprise teams running four or more AI coding tools cannot stitch a different regime together for each one. That is the problem Sonar solves.

Sonar is the global leader in AI code verification and governance. We make verification an inherent part of the agentic loop rather than a gate bolted on at the end.

• Sonar Vortex injects your project context, architecture rules, and security standards into the agent before it writes a line, then verifies each change in real time against SonarQube's algorithmic analysis, catching issues before they reach the pull request. Both steps happen inside the agent's loop, not after it.
• SonarQube is the independent verification layer that holds every change to the same zero-trust, multilayered standard, regardless of which human or agent produced it, at a false-positive rate under 3.2%.
• The standard stays consistent across Claude Code, Cursor, Codex, Copilot, and whatever ships next quarter. Your tools will keep churning; the standard they are held to should not.

SonarQube can help you turn Ian's discipline into something your organization can run at scale, across teams and tools, with an auditable record that standards were enforced.

The takeaway

Ian's methodology shows what happens when engineering gets applied to the whole production system: judgment, design, control, and accountability, amplified rather than abandoned.

Agents turn up the volume, and verification decides whether what gets louder is discipline or debt.

Listen to the full conversation with Ian Johnson on The Next Commit, then bring context, constraints, and real-time verification into your own agent loop with Sonar Vortex.