Guide

AI coding tools are leverage, not a substitute for engineering judgment. Used well, they compress boilerplate, exploration, and first drafts. Used poorly, they ship plausible bugs. The mode you pick should match the job.

The rule that keeps you safe: you own every line that merges, the same as if a junior teammate wrote it. If you cannot explain it, you cannot ship it.

Concept

An agentic coding loop is model plus tools (read, edit, shell) repeating until a goal condition is met. Quality depends on context, clear goals, and automated checks — not on longer prompts alone. See coding agents.

The spectrum

ModeWhat it doesBest for
AutocompleteNext tokens in the editorCompleting obvious patterns you already understand
ChatAnswer questions, draft snippetsExplaining unfamiliar code, sketching approaches
AgentsRead repo, run commands, edit many filesMigrations, test generation, multi-step refactors with a verify loop

Agents (Claude Code, Cursor agents, similar tools) close a loop: edit → run tests or build → read failures → edit again. That loop only helps if you give them a pass/fail signal — tests, typecheck, linters, or a scripted repro. Without verification, the agent is improvising with confidence.

Where they help — and where to slow down

High leverage: boilerplate (types, repetitive mappers, test tables), exploring unfamiliar codebases ("where is auth enforced for admin routes?"), mechanical migrations and codemod drafts, first-pass docs and PR descriptions you will edit, generating characterization tests around legacy functions (you still curate).

Human-mandatory: security and authz boundaries; concurrency, idempotency, money movement; subtle domain rules ("discount after tax in EU"); incident response under pressure — models hallucinate soothing wrong causes; anything you are supposed to be learning for the first time on the job.

Trade-off

For code on your critical path, draft with AI after you can state the invariants in one paragraph. For disposable spikes, generate first but throw away or rewrite before merge. Never merge the spike unchanged because it "seems to work."

Keep a personal red-flag list that always triggers manual rewrite: cryptography, permission checks, anything that deletes data, anything that sends money or messages to customers, and any migration that cannot be reversed. Let the model draft tests and scaffolding around those cores. Write or line-edit the core yourself.

Common mistakes

  • Using an agent as autocomplete for auth or money. Those stay human-mandatory.
  • No pass/fail signal. The agent improvises with confidence.
  • Merging a spike because it seems to work. Throw it away or rewrite it.
  • Asking the model to explain an incident under pressure. It soothes with wrong causes.

Check yourself

  1. You need to rename methods across 40 call sites. Which mode? An agent with a test as the pass/fail signal — plus your eyes on auth call sites.

  2. When do you write the core yourself? Crypto, permissions, deletes, money, customer messages, irreversible migrations.

Key takeaways

  • Autocomplete, chat, and agents are different tools.
  • Agents need a verify loop or they are guessing.
  • High leverage on boilerplate and exploration; human-mandatory on security, money, and concurrency.
  • You own every merged line.

Further learning

Next, make the loop honest in agent verify loops.