Shipping with models without losing craft

The useful version of “Shipping with models without losing craft” is narrower than the slogan: Put AI in the workflow — harnesses, evals, review norms — not on the slide deck as inevitability theater.

The rest develops that one idea with controls you can install and failure modes you can recognize.

Resist the urge to expand scope into neighboring slogans. If a control does not make Shipping with models without losing craft more operable for the next person, leave it for another note. Dilution is how coherent essays become stitched scrapbooks.

When pressure rises, teams drop the unowned practice first. Put Shipping with models without losing craft in the path of work — templates, checklists, review norms — or admit it was optional applause.

How it actually works

Start with controls that are boring on purpose: written owners, verification, and a path for the next person.

Define allowed tools and data boundaries. Copilots without policy become shadow IT with autocomplete. Secrets, customer data, and authz logic need explicit rules.

Shipping with models without losing craft requires the same standards you already had for human drafts, plus an explicit verification step because fluency hides gaps.

Update review norms when copilots arrive. If you do not, you will approve fluent bugs faster. Slow the merge until verification is explicit.

Keeping humans accountable when models draft code means the merge still carries a name and a verification note. Anonymized autocomplete is not an accountability model.

Evaluating AI assistance without vanity metrics means comparing escaped defects, onboarding time, and review quality — not counting accepted suggestions like arcade tickets.

Require a verification trail on assisted work: what the model changed, what a human checked, and where that note lives — PR, ticket, or decision record. Authorship is not ownership of production risk.

Measure assistance with outcomes you already care about: change-fail rate, review quality, escaped defects. Suggestion counts are arcade tickets.

Where this shows up

Someone pastes a production schema into a consumer model tool to “move faster.” Leadership had no published data boundary. That is not an individual ethics failure first — it is a missing control.

A literacy clinic walks through one authz bug introduced by an accepted suggestion. The room learns more than from a generic AI town hall.

A strong IC becomes a bottleneck because only they know the “good prompts.” Codify the harness: templates, allow-listed tools, eval snippets, and examples of refusals.

Tradeoffs

Verification notes add friction to the PR. They remove friction from the incident. Budget for the former.

Restricting tools feels anti-innovation until the first compliance event. Policy is what lets you expand autonomy later.

Tempo gains are real on boilerplate and real-negative on subtle invariants. Teach the difference explicitly.

On Shipping with models without losing craft, tempo is not the product. Verification notes, data boundaries, and review norms decide whether faster drafts become cheaper defects. Fluency is not evidence.

Shared harnesses beat private prompt folklore. If the “right way” lives in one chat history, you do not have a team practice — you have a bus factor dressed as productivity.

Failure modes

Each of these is a missing control, not a personality problem:

• Private prompt folklore instead of shared harnesses and policies.
• Treating model output as authority because it sounds senior.
• No coaching loop for juniors using assistants — mistakes accelerate.
• Leaders celebrating velocity while review quality quietly collapses.

What to do this month

• Publish allowed tools and prohibited data classes in the engineering handbook.
• Track escaped defects that originated in assisted drafts and coach from that set.
• Add a “human verified” checklist to PRs that used model drafts.

Publish what must never go into a model tool: secrets, unrestricted customer data, unresolved legal holds. Ambiguity here becomes shadow IT with a chat UI.

Where copilots help: boilerplate, test scaffolding, exploratory refactors with strong suites. Where they hide debt: security boundaries, concurrency, and domain invariants nobody wrote down.

AI changes tempo; leadership still owns outcomes. If escaped defects rise while suggestion counts rise, you optimized the wrong dashboard.

Prompting is not process. Harnesses are: allow-lists, templates, evals, and review norms that survive a teammate leaving.

Teach distrust of fluent wrongness. Models sound senior. Tests, invariants, and threat models still decide truth.

Treat “the model said so” as a non-reason in design review. Ask for the invariant, the test, or the threat model instead.

Measure assistance by outcomes you already care about — change-fail rate, review cycle time, incident escape — not vanity “lines generated” or “acceptance rate.”

Coach AI literacy as judgment: when to draft with a model, when to refuse, when to escalate. Literacy is a coaching problem, not a one-time workshop.

A team celebrates merged suggestion counts. Escaped defects rise in authz paths. The metric was vanity; the fix is tagging assisted PRs and reviewing that subset for verification quality.

A team bans AI briefly after a bad merge, then reintroduces it without new controls. The ban was theater; the missing piece was verification and data boundaries.

AI on the slide deck: logo, inevitability, no workflow. AI in the workflow: ticket → draft → harness checks → human verification note → review. Only one of those ships safely.

Close

Own the outcome. Let models accelerate drafts — never the truth.

If someone new cannot explain Shipping with models without losing craft from your artifacts in fifteen minutes, the practice is still private.