A passing build proves the code compiles, not that it follows the rules

A green build tells you the code works. It does not tell you the code is allowed. Gautam Korlam, who worked on Uber's SubmitQueue and on Gitar (now part of Sonar), made this point on the AI Engineer show. He argued that policy checks must run outside continuous integration (CI), the automated step that builds and tests every change.

What was said

Korlam said policies matter a great deal in regulated industries. He told a story about a company that lost its licence to operate in London. A software glitch had let drivers onto the platform without all the proper checks.

The cause was a change in the state of a feature flag, a switch that turns behaviour on or off. Afterwards, the company set a rule. Every change that touches London and passes through the development process must be checked with one question: what control measures are in place? The company got its licence back.

Korlam then widened the point to AI agents that write code. In his words: "The fact that code compiles does not mean that it conforms to a particular specification." He named HIPAA and DORA as examples. He said agents will not know about such policies unless people supply them. He also urged teams to record that a control was implemented, so it can be shown to auditors.

Why it matters

In the story Korlam told, a flag change let drivers onto the platform without the required checks, and the licence was lost. We think a change to a flag's state is easy for a test suite focused on code to miss.

For managers and buyers, the practical question is simple. Where are our rules written down, who checks each change against them, and can we show the evidence? Korlam said agents make it hard to see what is happening in a codebase. A written, enforced policy step, with a record of each check, does not depend on anyone's memory.

The other side

The excerpt is thin on method. Korlam gave one story and did not say what tool or process does the enforcing outside CI. The transcript also gives the company's name unclearly, so we do not name it.

There is also a tension in the talk itself. Korlam said checks are cheaper when moved earlier, but admitted that not everything can move. And he said many reviewers approve changes by habit because they cannot keep up with the volume. A new policy gate could be crowded out in the same way. The talk raises that pressure but does not settle it.