Engineering leadership
How do I audit why an AI-generated code change was made?
Preserve a provenance chain that answers who or what proposed the change, which requirement authorized it, what evidence supported it, which product premise was current, and who made any material decision.
Record the decision context
Commit messages and pull-request descriptions are useful but insufficient. They can be edited, omit upstream context, and rarely distinguish a draft from an authoritative decision.
Store the linked artifact identifiers, their exact versions, the current product chain, detector conclusions, and reviewer dispositions. Bind the record to the pull-request head that was evaluated.
Source
Identify the agent, human, issue, prompt context, and execution artifact behind the change.
Authority
Record which premise was ratified and which proposals remained drafts.
Evidence
Keep the tests, static observations, semantic rationales, and unavailable checks behind the verdict.
Make the audit replayable
A future reviewer should be able to reconstruct the decision from stored identities and versions without trusting a generated summary. Summaries help navigation; they are not the audit authority.
Helen’s Foundry links product artifacts, code symbols, pull requests, findings, and decisions. It preserves the difference between machine evidence and human authority.
Audit changes in context
The important question is not only who wrote the code. It is whether the organization currently intends the change and whether the evidence justifies shipping it.