Yesterday Claude found an authorization bug in Auto that I had no idea existed, and then spent the afternoon confidently trying to talk me into rebuilding something we'd already built.
Then I thought, it's actually a perfect illustration of the current state of coding agents right now, where they're excelling, and where they still can't go.
Authorization is tedious, but failure means a breach. It's the kind of thing every app building platform gets wrong today, and I was knee-deep in meta-authZ inception: building authZ with AI for a platform that builds apps with AI with authZ.
Now, we've got debug backdoors in our dev env that give Claude API access to all the things, so as per my harness it spun up the app, watched the logs, and found a gnarly bug on its own! Then it wrote the test, wrote the fix, proved it end-to-end, and gave me back the wheel.
I was chuffed.
Now, if I'd only shown you that part of the day, you'd think software engineering was basically solved. But then we got to the design, and it went sideways!
What we built into Auto, is a way to continuously and mathematically prove that generated apps allow the right people, and deny the wrong ones. I had a plan, but Claude swore a fundamental part was missing. I went around the houses with it, doubting my own sanity, while it argued with total confidence. It even drew diagrams! But my biological "blink" brain kept saying something didn't smell right, and the whole thing was completely and utterly unnecessary.
The thing it wanted was already derivable from rules we'd written weeks ago, baked into our deny-by-default authZ layer. I happen to know the engineer who built that layer very well, he's my cofounder and brother, Rami.
Now, Rami doesn't push half-finished abstractions, it's just not a thing he does. So when an agent claimed his work couldn't express something foundational, my instinct was to doubt it. I sent it back to read the code, and minutes later it found the exact thing he'd written two weeks ago.
The agent doesn't know Rami, nor who on the team is meticulous, whose code you quietly double-check, and whose you trust on sight.
A surprising amount of senior engineering is exactly that, knowing which code to doubt and which to believe. That spidey sense is still essential, and it's the part agents just can't do.
Which is the whole reason we're building Auto the way we are. We want authorization that's secure by default and still standing after a thousand prompts, built for product engineers who are far past vibe coding but shouldn't moonlight as security engineers, nor get gaslit by an agent confidently saying they have it all under control!
The fact is, what saved me yesterday was just knowing Rami, how he builds and that he doesn't leave things half-done. None of that's in the repo, and it's nowhere in the agent either, and I reckon it will stay that way a very very long time. But you probably already knew all that!
PS — the em-dashes are mine ;]
