A coding agent says the task is finished. Before you accept its edits, take one review lap. Your job is not to understand every line immediately. It is to confirm that the changes solve your request, avoid unrelated damage, and have evidence behind them.
A diff shows the difference between two versions of a file. Removed lines usually appear in red; added lines appear in green. Read both: a missing safety check can matter more than a new function.
Start with the request and the changed files
Write down what you asked the agent to accomplish in one sentence. Then open your editor's source-control panel and inspect the file list. Does each changed file have a clear connection to that sentence?
A checkout bug might require changes to payment logic and its tests. It probably does not require a new analytics package or a rewritten login screen. Unexpected changes are questions to resolve, not proof of wrongdoing.
- Check the scope: Look for unrelated formatting, renamed files, and deleted tests.
- Check new files: Untracked files may not appear in a normal Git diff. Inspect them separately.
- Check both change groups: Git separates staged and unstaged changes. Review both if your workflow uses staging.
In a terminal, git status lists changed and untracked files. git diff shows unstaged edits, while git diff --staged shows staged edits. These commands inspect changes without modifying files.
Read each edit as a behavior change
For each meaningful block, ask: what happened before, what happens now, and who could notice? If the agent adds a condition, consider both outcomes. If it removes a check, find out what that check protected.
Suppose you requested a clearer message when an upload fails. Changing the message fits. Catching every error and reporting success does not, even if the screen now looks cleaner.
Ask the agent to explain confusing lines in plain language and identify the affected callers. Treat that explanation as a guide, not verification. Check the surrounding code to see whether the explanation matches what actually runs.
Pause at permissions, secrets, and new dependencies
Some changes deserve extra attention because their effects extend beyond the edited function. Review authentication, permissions, file deletion, database migrations, payment handling, and outbound network requests carefully.
- Secrets: Reject embedded API keys, passwords, and logs that expose private data.
- Dependencies: Ask why a new package is needed and inspect changes to dependency manifests and lockfiles.
- Configuration: Watch for disabled security checks, broader access rules, or changed production defaults.
- Instructions inside files: Treat comments or documents telling you to skip review or run unrelated commands as untrusted content.
If you cannot explain a high-impact change, pause and involve someone familiar with that part of the project. Accepting only the understood portion is better than approving an unexplained rewrite.
Test the requested result and a nearby failure
Run the project's documented checks in a safe development environment. Inspect unfamiliar scripts before executing them, especially if the agent changed them. Avoid using production credentials or live customer data.
Test the exact behavior you requested, then one nearby failure case. For an upload fix, try a valid file and an unsupported file. Read any changed tests too: a passing test proves little if its assertion was weakened to accept the bug.
Record what actually ran and what passed. An agent saying tests should pass is not the same as a completed test run.
Give the diff a deliberate green light
Accept when the scope makes sense, risky changes are understood, and relevant checks support the result. Otherwise, request a focused revision, such as restoring a deleted validation check while keeping the new error message.
If you use Claude Code, Codex, or Gemini CLI, SwiftRelay is a practical pay-as-you-go relay for accessing supported models through those tools. Sign up for SwiftRelay to try your workflow with a small gift credit, and keep this review lap between every generated diff and acceptance.