You have to know what you don't know

An AI coding agent will write you a confident answer to almost anything. That is the useful part and the dangerous part, and they are the same part. Ask it to wire up a payment flow, hash a password, handle timezones, or apply a tax rule you half-remember, and it will produce clean, plausible code with the calm authority of someone who has done it a hundred times. Sometimes it has. Sometimes it is guessing, and it guesses in exactly the same tone it uses when it is right.

The problem is not that the AI is wrong sometimes. The problem is that you cannot review what you cannot evaluate.

It amplifies your competence and your ignorance

In a domain I know well, the AI makes me faster. It writes the obvious code, I read it in a second, I catch the one thing it got subtly wrong because I already know what right looks like. My judgment is the filter, and the filter works.

In a domain I do not know, the same tool makes me faster at shipping something I cannot vouch for. It hands me a working-looking auth flow and I nod, because it compiles and the happy path runs. I have no idea that it is storing a token where it should not, or that it is one race condition away from double-charging a customer. The code looks exactly as competent as the good code. That is the trap. AI amplifies whatever you bring to it, and if what you bring is confidence without competence, it amplifies that too.

The failure mode is plausible-but-wrong

Every field has a floor of expertise below which mistakes stop being visible to you. Security is the classic one - the code that leaks the secret looks identical to the code that does not, unless you know the pattern. Accessibility is another: the AI will happily build an interface that a screen reader cannot navigate, and it will look perfect on your monitor. Concurrency is a third - the bug only shows up under load, at 2am, in production. And then there are the domain rules. A tax calculation, a medical dosing constraint, a rule about how invoices round in a particular jurisdiction. The AI does not know your domain's landmines. It knows the average of everything it has read, and the average is often wrong in the specific.

In all of these, the code passes the only test you are equipped to run: it looks right. That is not review. That is a vibe check.

Two honest fixes

There are exactly two ways out of this, and only two.

The first is to learn enough to actually review it. Not become an expert - just climb above the floor where you can tell good from bad. Read the OWASP guidance before you let the AI touch auth. Understand what makes a form accessible before you accept the form. This is slower, and it is often the right call, because judgment you own transfers to every future project.

The second is to encode an expert's method once, as reusable context, so every task inherits it. This is the move that AI agents make genuinely new. If I cannot hold all of accessibility in my head, I can capture how an expert does it - the checklist they run, the patterns they insist on, the reference implementation they trust - and hand that to the agent as a document, a rule file, or in Claude Code, a skill. Now the AI is not guessing from its training average. It is following a named method, the way a junior would if you sat a specialist next to them.

A skill is a captured method

That word "skill" is doing real work, so let me be plain about it. A skill, in the way I use it with Claude Code, is not magic. It is a file that captures how a competent person does a specific thing, so the agent does it that way every time instead of reinventing it badly. Here is the accessibility checklist. Here is how we handle money - always integer cents, never floats, here is the rounding rule. Here is the reference implementation for our auth, copy its shape. Here is the tax logic, written down once, correctly.

You write it once. Then every future task in that area starts from real expertise instead of a plausible guess. The value is not that it saves typing. The value is that it moves the AI from "average of the internet" to "the way we actually do it here," and it keeps doing that long after you have forgotten the details. It is the difference between an agent that guesses and an agent that follows a method.

Honesty about your gaps is the meta-skill

All of this rests on one uncomfortable habit: being honest with yourself about what you do not know. That is harder than it sounds, because the AI's confidence is contagious. When it produces something slick in a domain you are shaky on, the easy move is to relax and assume it knew what it was doing. The disciplined move is to notice the unease - I could not have written this and I could not catch it if it were wrong - and treat that unease as a signal, not something to suppress. That flicker of "wait, am I actually qualified to approve this?" is the most valuable instinct you have when you build with AI. Every real safeguard starts there.

This is also, quietly, why a specialist beats a generalist letting the AI wing it. It is not that the specialist types faster or knows more incantations. It is that the specialist knows where the bodies are buried in their domain - which "working" code is actually a liability - and knows exactly which expertise to hand the agent so it follows the real method instead of the plausible one. The AI raised the ceiling for everyone. It did not lower the floor. Someone still has to know what right looks like, and be honest about when they don't.