Most engineering teams have their token budget pointed in exactly the wrong direction. They spend the bulk of their AI spend generating new code and almost nothing defending what they already shipped. The ratio is out of whack, and it should shift now.
Here is the rule I keep coming back to: for every token you spend building a feature, spend two making sure it stays working. When teams actually measure this, the mature ones land around 80 percent of their token usage on existing code rather than net-new features. That is not a failure. That is what a healthy codebase looks like when agents are doing real work.
The common reflex is to keep agents away from the important stuff. Ledgering, financial transactions, the core processing engine that runs your business. That is where people say "humans only, hands off." I think that is backwards. The critical path is exactly where an agent earns its keep, because that is where you want relentless, non-negotiable test coverage. AI writes better tests than most humans. I have known engineers who are genuinely great at TDD, but the average developer under shipping pressure is not building perfect tests around the critical section. An agent whose entire job is to guard that section will.
This is a recent shift. If you tried defensive agents six or nine months ago, they were dumb and you gave up. Today's coding agents silently write tests, fix tests, and test the tests without being asked. That changes the economics of what is safe to automate. The thing that felt reckless last year is now the responsible move. This is why I keep arguing that human review is not a limitation. It is the layer that makes aggressive automation safe.
Stop treating your critical code as the place agents cannot go. Treat it as the place they need to live permanently, standing guard. Point a defensive agent at your most important paths, give it a test framework, and let it hold the line. The feature you ship next quarter matters less than the ten features that quietly keep running because something was watching them the whole time.
Key takeaways
- The instinct to keep agents away from critical code is backwards - critical code is exactly where agents add the most durable value.
- For every token spent shipping a feature, spend two making sure it keeps working.
- Modern coding agents write and maintain tests silently and diligently, which was not true even six months ago.
FAQ
Isn't AI-generated code too risky for critical parts of the codebase?
The risk is not the agent, it is the absence of guardrails. An agent whose job is to maintain rigorous tests around a critical section is more reliable than a rushed human under shipping pressure. The critical path is where defensive agents earn their keep.
What does the right token ratio look like in practice?
Teams that measured it report roughly 80 percent of token spend going to existing code rather than new features once they mature. New features are the exciting spend, but the durable value comes from continuously defending what already runs.
Sources
Related Essays
Human Review Is Not a Limitation
Human review is not the bottleneck to be eliminated. It is the quality gate that keeps AI-generated slop from compounding into technical debt that takes years to unwind.
Controllability Beats Magic Every Time
Enterprise teams do not want a black box agent. They want full control over how code gets written, reviewed, and shipped.
Review the Session, Not Just the Diff
When an agent writes the code, the diff is half the artifact. The session that produced it carries the intent, and reviewers need access to it.
Drowning in pull requests that need your review? Try Tembo Review, a beautiful AI-assisted PR review tool unlike anything you’ve used.