The Sign-Off Layer Is Becoming the Real Engineering System
The Long Commit
SubscribeSign in
The Sign-Off Layer Is Becoming the Real Engineering System<br>AI made code generation cheaper. The part that still matters is whether a human can understand, verify, and own what the agent produced.
Juan Cruz Martinez<br>Jun 09, 2026
Share
Let me start with a story: A senior engineer opens a pull request, everything looks good, the tests pass, the description is clean, the diff is a bit long but nothing crazy. There are comments explaining the migration path, a generated test file, and one of those careful little summaries that makes the whole thing feel more understood than it probably is.<br>But then, the PR states, coauthored with Claude Code (or any other harness for that matter). It comes with no surprise nowadays that AI had its claws all over the code, but there’s an interesting question that I think needs answering. Who is truly responsible for the changes? Is there a human being who’s willing to say they understand the change well enough to own it when it breaks, defend it in review, explain it during an incident, and accept the consequences of having let it into the system?<br>That is the part of AI-assisted engineering that still feels under-discussed to me. We spend a lot of time talking about the generation layer. Which model wrote the code. Which agent can use the terminal. Which IDE has the better context window. Which benchmark moved by three points.<br>But the production system does not end when code appears.<br>Today, we cover:<br>Why AI made the approval step more important, not less important.
Why the engineering work is shifting from creation toward supervision.
Why faster code generation exposes the rest of the delivery system.
What sign-off actually means once agents can create real artifacts.
What a sane sign-off system might look like without turning every autocomplete into a compliance event.
The short version is this: AI made generation cheaper. It did not make ownership cheaper.<br>1. The approval step did not go away
The cleanest AI coding policy I have seen recently comes from a place that is not known for being loose about software process: the Linux kernel.<br>The penguin itself doesn’t ban the use of AI as maybe some of you would expect, but it doesn’t recognize it as an entity in the process either. It treats AI-assisted contributions as any other contribution. All contributions still need to comply with licensing requirements. AI agents must not add Signed-off-by tags. Only humans can certify the Developer Certificate of Origin. The human submitter is responsible for reviewing the generated code, ensuring licensing compliance, adding their own sign-off, and taking responsibility for the contribution.<br>That last part is the system.<br>The kernel also added an Assisted-by tag for AI involvement, including the agent name, model version, and relevant tools. The point is not to shame anyone for using AI. The point is to keep the work attributable enough that reviewers and maintainers can reason about what happened.<br>The companion tool-generated content guidelines are even more explicit about the underlying problem. Tooling can increase contribution volume, but reviewer and maintainer bandwidth is scarce. If a meaningful amount of content was created by a tool, contributors should be transparent about the tool, the affected parts, the input when it matters, and how the submission was tested.<br>My read is that the kernel landed on the right framing because it did not start from AI exceptionalism. It started from the existing engineering practices.<br>The contribution has an origin. The origin needs to be legible. A reviewer needs to know what they are reviewing. A maintainer needs to know who understands the change. A human in the sign-off chain needs to be able to answer questions later.<br>And this is important! it’s a process with three layers.<br>The generation layer is where the agent creates something: code, tests, dashboards, documentation, migration plans, internal tools, release notes, incident summaries, or the first version of a design.<br>The verification layer is where someone checks whether that thing is correct, secure, licensed, observable, compatible with the existing system, and appropriate for the operational risk it carries.<br>The sign-off layer is where a human accepts ownership in a way the organization can audit later.<br>Most of the AI tooling conversation is still obsessed with the first layer. That makes sense. Generation is where the demo happens. It is where the speed is visible. It is where a model can do in three minutes what used to take an afternoon.<br>But the expensive part of engineering was never only producing text that compiles.<br>The expensive part was knowing what that text means inside a system that already exists.<br>2. The work is moving from creation to supervision
This is not just a philosophical concern. The work is already moving.<br>In a longitudinal study submitted to arXiv on May 22,...