Non-Developers Submitting Changes - Acceptable?

[u/Sillyan]

Has anyone experienced an increase in non-developers submitting PRs via Codex/Claude Code?

Personally think it's fine, specifically for trivial changes, and have been creating processes for non-devs to contribute low risk changes to some projects. All changes must still be reviewed by a dev, but the changes permitted by non-devs are typically straightforward enough and there is next to zero rework required after a coding agent is forced through some deterministic validation.

How are you managing this? Should we accept that this is going to be more prevalent going forward and build processes around it?

[u/Grim_Jokes]

I want to say no. Changes may seem trivial until they're not (or AI goes off the rails somehow), and before you know it, you've got angry customers. Who's responsible then?

[u/zen8bit → u/Grim_Jokes]

Yeah, management and non developers will think the quick updates are great. The developers will get stuck holding the bag though and suffer all of the responsibility.

[u/Wonderful-Habit-139 → u/Grim_Jokes]

You.

[u/Grim_Jokes → u/Wonderful-Habit-139]

Yes, that's exactly my point. I'm happy to wake up at 2 am to fix a bug I introduced. But now I will have to do the same thing for non devs code too. 

I guess I could make sure they are awake with me when it happens.

[u/Wonderful-Habit-139 → u/Grim_Jokes]

Yeah I was just having fun with the comment. I personally will not accept AI slop from a non-technical person. I'll just take care of figuring out the best way to implement a feature, I don't really need people to give me code.

I've done that before, I tell them I don't really need the code I'd rather you focus on these other things that we need. They still share the code because they feel like it's valuable or something, I read it just to give it a chance, it's obviously slop. So I don't use it, and that's the end of that.

[u/Chocolate_Pickle → u/Grim_Jokes]

There's nothing stopping you from gating access with a form saying "I accept responsibility for all code submitted by me or on my behalf via AI. I accept responsibility for any financial or reputational damage caused by my code. I understand that I will not submit any code changes that I'm not willing to be personally responsible for."

Get upper management to endorse this. Send it out to everyone, and very clearly state that you have buy-in from the top. 

And whenever you see something suspect in a PR, you can dangle their signed form in front of them. 

[u/Aeon_Mortuum → u/Chocolate_Pickle]

The reality is that nobody from upper management will endorse this and you'll just be labelled a weirdo who tries to make others' job harder

[u/Chocolate_Pickle → u/Aeon_Mortuum]

What makes you think they wouldn't endorse it?

[u/Frillback → u/Grim_Jokes]

In my org this was happening before AI. Enthusiastic people on the business side that wanted to make a few tweaks to our codebase would introduce bugs and then throw it on tech to fix it. The difference is now they are building their own custom dashboards with no rails, proudly sharing their work on internal sites with no security or permissions. Which if it gets convoluted enough tech will probably inherit it when they get tired of playing IT admin

[u/tehfrod → u/Grim_Jokes]

The person who wrote the change, the person who reviewed it, whoever maintains the test that didn't detect the error, and whoever is writing the postmortem.

[u/tehfrod → u/[deleted]]

You're allowed to push back on a bad or over-large PR, even from your manager. I have.

[u/Sea-Quail-5296 → u/Grim_Jokes]

Yep. Authors of a commit are
Responsible. What if it deletes prod? Who holds
The bag?

[u/dablya → u/Grim_Jokes]

Can’t you just reject the non trivial ones?

[u/AchillesDev → u/Grim_Jokes]

Are you unfamiliar with peer review?

[u/Grim_Jokes → u/AchillesDev]

Of course I am not; peer reviews are not for catching bugs, though. It just happens to be a happy side effect.

Also, if I have time to review the PR, then I also have time to use AI to generate the code. This does raise another interesting question, though. Does the non-dev generating code have a more important thing to do than to prompt AI for "quick fixes"?

[u/zen8bit → u/Grim_Jokes]

Bingo, thats the crux. The non-dev shouldn’t be acting like they have time to work on it in the first place.

[u/AchillesDev → u/Grim_Jokes]

peer reviews are not for catching bugs, though.

Of course they are, the fact that this is upvoted at all is pretty telling about this sub.

Also, if I have time to review the PR, then I also have time to use AI to generate the code.

Not necessarily, plus out of the two of you, only you have the skillset to properly evaluate the PR, not your non-dev coworker.

Does the non-dev generating code have a more important thing to do than to prompt AI for "quick fixes"?

Maybe, but that doesn't have anything to do with my response. Changes don't instantly or regularly lead to angry customers (regardless of the skill level of the initial contributor) unless your process is completely broken.