IBM calls it a building inspector. We ran the inspection.

In June, Katie McDonald published a video on the IBM Technology channel called "What Is Agentic Coding? How AI Agents Modernize Code". The framing is clear: developers spend most of their time understanding code, not writing it. The video cites the well-known finding that comprehension consumes 60–70% of engineering hours. The fix is an AI partner that works like a building inspector with x-ray vision. It maps the whole structure before anyone touches a wall. The loop has five steps:

• Analyze the codebase and chart its hidden dependencies.
• Mark the safe boundaries for change.
• Generate tests that cover the ugly cases, not just the happy paths.
• Put a human gate in front of every change.
• Run old and new code side by side until the outputs agree.

It's a good framework. We know because we ran most of it, on one of our own products, before we'd ever seen the video.

Why we believed it enough to test it

The subject was a production SaaS from our portfolio: a TypeScript application on a managed Postgres backend, with row-level security handling data isolation and an LLM in the request path. The detail that matters isn't the stack. The codebase had a single author, and the audit was run by that same person eighteen months later. This is where the "we" must pause for a few paragraphs, because what follows is a story about one person's assumptions, and pretending otherwise would be its own kind of undocumented dependency.

The video's house metaphor assumes you inherited the building from a stranger. Nobody warns you that eighteen months is enough time to become a stranger to your own architecture. The rooms were familiar. The reasons for the wiring were not.

What actually happened when I ran the inspection

I ran step one roughly as described: multiple coding agents in parallel, each assigned a different suspicion. One walked the row-level security policies. Another traced webhook handling end to end. A third read the billing state machine. Then I synthesized their findings.

The RLS agent earned its keep quickly, flagging permission issues of the boring, dangerous kind. But the webhook agent found what justified the whole exercise. The payment provider's webhooks arrive in whatever order the network allows. My reconciliation logic quietly assumed they wouldn't. The local subscription record was a cache of the provider's truth, the webhook was its only writer, last write wins, no refresh path. A specific delivery sequence could silently downgrade a paying user, and every test I had passed anyway, because tests written by the person who made the assumption inherit the assumption.

The worst part wasn't the drift itself. It was the failure mode. A silently downgraded user's only escape was to pay again: double billing, a probable chargeback, a certain bad review, and nothing in the logs. This is the video's "undocumented sequence" point, except the missing documentation was in my own head, where it had rotted.

Step four of the loop is the human gate, and I'll defend it more strongly than the video does, because the agents were also wrong. Confidently wrong, with line numbers. An earlier full review of the same codebase found thirty-four critical issues. On triage, most collapsed into each other. One was an N+1 query, flagged accurately to the line, in a function nothing calls. Several were "unauthenticated endpoints" in files that had been dead code for months, where the fix was to delete them. I could dismiss each in minutes because I knew the actual call graph. An agent reviewing an unfamiliar codebase would have filed them all as P1s, and someone would have burned days. The gate is where domain knowledge does the only job AI cannot do yet: knowing which alarms are false.

Step five, the side-by-side parallel run, didn't happen at all. The reason is worth a section of its own.

Where the video ends and reality begins

Three things we'd add to the loop, all learned the unglamorous way, and none of them specific to any particular stack.

The inspector needs a second opinion from someone who isn't an inspector. Here's the structural problem with an LLM auditing LLM-written code: they share blind spots. The same model family that wrote the plausible-but-wrong assumption is now grading it, and correlated errors don't cancel, they compound. So our loop grew a sixth step the video doesn't have: decorrelated verification through tools that don't think at all. Static analysis. Secret scanners. The database's own advisor reports, which caught a configuration our agents' narratives never surfaced (tables with row-level security switched on and zero policies attached, a setup that fails silently and reads as "secure" until it matters). The clearest case from our logs is humbler. A permissions drift we fixed once reappeared a week later on newly created tables. Not malice, process. No reviewer, human or agent, reliably catches a recurring class. A deterministic test asserting that the anonymous role holds zero privileges outside an explicit allowlist catches it every run, forever. None of these tools are smart. That is their entire value. A dumb tool with different failure modes is worth more as a check than a second brilliant tool with the same ones.

The full parallel run is an enterprise answer to an enterprise question. Running old and new systems side by side with mirrored traffic assumes dedicated infrastructure and a traffic volume that makes statistical comparison meaningful. Most products, ours included, clear neither bar, and pretending otherwise produces theater rather than safety. Our substitute is risk-tiering. Changes touching high-blast-radius surfaces (auth, billing, anything with data-isolation policies in the diff) go through the full gauntlet, independent review included. Low-risk changes get an agent self-review and a merge. It's not the video's answer. It's the answer that ships.

The 60–70% doesn't disappear. It moves. The video is right that agents collapse the comprehension phase. But the hours reappear downstream, in reviewing what the agents claim about your system. That review demands more domain knowledge than the reading it replaced, because now you're auditing an articulate stranger's confident summary of your own house. Thirty-four criticals collapsing into a short, real list is exactly that work. The economics still come out ahead in our experience. But anyone selling this as effort deleted rather than effort relocated hasn't run the loop on a system they answer for.

The part IBM got most right

Late in the video, McDonald lands on the framing that deserves to outlive the rest: the AI is a good doer, not a thinker. Having run the inspection, we'd sharpen it. The agents did archaeology no one here would have finished, and found a real, structural bug our own tests were constitutionally incapable of catching. They also raised confident false alarms that only system knowledge could dismiss. Both facts are the point. The inspector sees through walls. It doesn't know which walls are yours. That part of the job, for now and probably for longer than the demos imply, still belongs to whoever holds the keys.

Based on and in response to Katie McDonald, "What Is Agentic Coding? How AI Agents Modernize Code," IBM Technology, June 2026. The 60–70% comprehension figure is the video's citation of a long-standing finding in program-comprehension research.