Code Review Is Not an Authority Boundary

In an era where AI can rapidly generate software, Ken Walger argues that traditional code review is insufficient for ensuring system security. While code review evaluates implementation, it fails to address the 'authority' granted to that code. Walger highlights that sandboxing constrains where code runs, but capability-based security is required to define what code is permitted to affect. Using a Python-based experiment, he demonstrates that even 'correct' code can be over-privileged. He concludes that as implementation becomes cheap and disposable, the focus must shift toward durable, explicit capability manifests. Rather than relying on human reviewers to catch potential abuses, developers should implement independent, policy-driven authority boundaries. This approach ensures that even if an AI-generated component is flawed or malicious, its impact remains limited by the specific, minimal permissions granted by the host environment, effectively separating behavioral correctness from system-level authority.