Problems & Workarounds

Each entry follows the same shape: Problem → Impact → Workaround → Status. Honesty here is the point - reviewers trust a team that documents what broke.

1. Hallucinated APIs and libraries

Problem: AI confidently referenced SDK methods, NuGet packages, and config options that don’t exist. Impact: wasted developer time chasing non-existent APIs; one near-miss where a suggested package name resembled a known typo-squatting target. Workaround: mandatory “does this compile and does this package exist” check; verify any unfamiliar dependency against the official registry; SCA scanning in CI catches malicious/unknown packages. Status: contained. Slows experienced developers down little; we coach juniors specifically on this.

2. Insecure or wrong-by-default generated infrastructure

Problem: generated Terraform/Helm/K8s manifests came with permissive IAM, public buckets, missing encryption, or the wrong region. Impact: would have created real security and cost exposure if applied unreviewed. Workaround: policy-as-code gates (tfsec, OPA/Conftest) on every plan; the Architect reviews all generated IaC; no AI-generated infra applies without passing automated policy checks. Status: resolved via pipeline gates - the safety net is now the process, not vigilance alone.

3. AI review noise / alert fatigue

Problem: early AI code review produced too many low-value comments; developers began ignoring all of them, including the good ones. Impact: the tool’s value nearly evaporated within two sprints. Workaround: tuned the rules, suppressed stylistic nitpicks already handled by the linter, and scoped AI review to bugs/security/missing-tests. Made the human Quality Engineer the decision-maker. Status: resolved. Signal-to-noise is now acceptable; we re-tune quarterly.

4. Tests that pass but assert nothing

Problem: AI-generated unit tests sometimes asserted trivialities or mirrored the implementation, giving false confidence. Impact: coverage numbers looked healthy while real behavior went unverified; a defect escaped to functional testing that “had a test.” Workaround: review test assertions, not just counts; the Quality Engineer treats generated tests with extra scrutiny; we track defect-escape rate, not just coverage. Status: ongoing discipline. No tooling fully solves it - it’s a review-culture fix.

5. Domain rules invented in requirements

Problem: AI-drafted stories occasionally embedded plausible-sounding but incorrect business rules. Impact: one story was built to the wrong rule and caught only at Review - a sprint of partial rework. Workaround: BA validates every AI-drafted rule against a real SME before the story enters a sprint; acceptance criteria explicitly cite the source of each rule. Status: resolved via the refinement checklist.

6. Data-boundary and IP leakage risk

Problem: temptation to paste client code or stack traces (with secrets) into consumer AI tools. Impact: potential contractual and security breach. Workaround: enterprise-tier tools that don’t train on our data; a clear data-classification policy (see Governance); secrets scanning; team training. Status: controlled by policy + tooling; reinforced in onboarding.

7. Over-reliance eroding fundamentals

Problem: some developers began accepting AI output they couldn’t fully explain. Impact: weaker code ownership; harder, slower reviews. Workaround: the rule “if you can’t explain it in review, you can’t merge it”; pairing juniors with seniors; AI as a learning aid (“explain why”) rather than an answer machine. Status: ongoing cultural reinforcement.

8. Inconsistent results across tools and versions

Problem: model updates changed output quality and behavior unpredictably between sprints. Impact: a prompt that worked last sprint regressed; hard to standardize. Workaround: shared, version-controlled prompt patterns per role; pin enterprise model versions where possible; treat prompts as artifacts we maintain. Status: managed, not eliminated - model churn is a fact of life.

Pattern across all of these

flowchart LR
    P[AI capability] --> R[New failure mode]
    R --> G[Add automated gate in CI/CD]
    R --> H[Add human checkpoint]
    R --> T[Train the team]
    G & H & T --> S[Contained & measured]

Every problem was contained by some combination of an automated gate, a human checkpoint, and training - the same three levers described in Governance.