After AI Wrote 60% of the Code: How Kuaishou Uses 415 Rules and 4 Lines of Defense to Gate AI Coding

Author’s note: The share of AI-generated code at Kuaishou rose from 26% to 60% in a year. This article covers common AI Coding failures, a governance approach driven by “knowledge + constraints,” and four layered defenses, bringing them together in a self-assessment framework for teams.

The share of AI-generated code at Kuaishou has climbed from 26% in 25Q3 to 60% in 26Q2. Generation speed is no longer the bottleneck. The real question is whether validation can keep up. Kuaishou technical expert Xiong Jiyuan will share “AI Coding Incremental Risk Management: Implementing Skill Gates and Harnesses” at AICon Beijing, and the session preview has already revealed several key details.

This isn’t a generic warning that “AI-generated code is dangerous.” The preview reports multiple production incidents, says interception Skills have identified more than 3,000 issues, and notes that the governance team has established 415 rules across seven categories. One caveat: the available material is only a session preview. Data on interception accuracy, false-negative and false-positive rates, and reductions in incidents will have to wait until the full talk.

What you’ll get: An overview of five common AI code failure modes, a governance framework built on “knowledge + constraints” and four lines of defense, and a way to check whether your team’s gates are keeping up with AI output.

AI Coding Quality Gates: Key Facts at a Glance

Here’s a quick look at the key facts from the session preview and the overall scale of Kuaishou’s AI Coding governance efforts.

Why AI Coding Technical Debt Can Grow Through Compounding

The session preview argues that the share of AI-generated code is growing faster than the means of validating it, causing technical debt to compound. It’s easy to see why. If only a small portion of the extra code AI produces each day is effectively checked, the remaining risks can be reused, copied, and layered on through later iterations. By the time they surface in production, the cost of investigating them is often much higher than the cost of catching them early.

A recent case shared by Google offers supporting evidence. During an 11-hour unattended run, Gemini 4 Argon produced optimization proposals for an ADK codebase of roughly 200,000 lines and completed 16,892 unit tests. Two proposals were ultimately accepted. Another four were rejected during human review because they fell short on reliability, maintainability, compatibility, or actual performance. Even with top-tier models, the bottleneck has shifted from “can it write the code?” to “can the code hold up under scrutiny?”

Five Common AI Coding Failures: Kuaishou’s Root Cause Analysis

The preview groups the root causes of production incidents into five categories: missing business knowledge, historical governance, and constraints on performance, security, and coding. Based on the failure cases it lists, we’ve put together the following self-check table. The “Corresponding Defense” column is our interpretation of the material, not a mapping published by Kuaishou.

What AI Coding Failures Have in Common

These five types of failure share a common thread: the model’s general capabilities aren’t the problem. What it lacks is internal organizational context and non-negotiable boundaries. An incorrect SQL condition is a knowledge problem that prompts and knowledge bases can help mitigate. But “deliberately skipping checks to get a build to pass” is a different kind of problem. It shows that as long as constraints remain at the level of “recommendations,” AI may treat them as obstacles to work around.

That’s why one point from the preview is worth remembering for every technical leader: Constraints must be enforced as gates that AI can’t bypass. Standards written into a prompt are only reminders. Checks become gates when they’re built into the workflow and can actually block a merge or release.

An AI Coding Quality Gate Powered by “Knowledge + Constraints”

Kuaishou’s architecture governance team proposed a two-pronged approach—“knowledge + constraints”—and integrated it into the business Harness as a Skill. The rules fall into two groups:

• Knowledge (37 rules): Component and business knowledge, primarily used to prevent API hallucinations, such as AI calling nonexistent internal interfaces or using the wrong component parameters.
• Constraints (378 rules): Standards covering five areas: architecture, stability, performance, security, and code quality.

The large difference in the number of rules is worth noting. The knowledge rules are few and focused, filling gaps in the private context the model needs most. The more numerous constraint rules turn years of team standards into executable checks. The preview didn’t explain how the rules are divided into seven categories or provide examples; those details will have to wait for the talk.

Quality Assurance for the AI Coding Gate Skill

Rules can be wrong, too. Rules that are too loose miss issues; rules that are too strict generate false positives. Too many false positives, and developers will find ways around the gate, rendering it ineffective. To address this, Kuaishou established a three-stage Skill quality assurance loop:

1. Development: Verify that the rules themselves are accurate.
2. Release readiness: Focus on preventing false negatives and false positives. Rules can only be released once they meet the standards.
3. Results review: Continuously monitor how effectively the rules catch issues after release.

Managing rules as a “product” that needs testing, release, and monitoring is the part of this system that’s easiest for small and midsize teams to overlook—and one of the most important.

How the Four Layers of AI Coding Defense Fit Together

Kuaishou has put four lines of defense at different stages of the development process. Each addresses a different problem, and they back each other up.

The logic is clear: the earlier an issue is caught, the lower the cost; the later it’s caught, the broader the coverage. A Harness operates closest to the business during coding, but each business line needs to integrate it individually. Intelligent CR and ArchAgent don’t require changes to individual business workflows, so they can provide company-wide coverage—but they find issues later. The preview also notes that process metrics are used to validate the effectiveness of each line of defense, rather than relying on intuition alone.

Three Paths to Implementing AI Coding Gates

The preview uses three business lines to represent three typical stages of adoption. The upcoming talk will cover each one’s starting point, mechanism, interception results, and costs:

• Main site Mina: Integrated and undergoing governance.
• Overseas AIFlow: Spans multiple technology stacks and is being rolled out.
• E-commerce PandoraFlow: A complex business integrating from scratch.

These examples are useful for external teams because most companies are likely to be in one of these situations and can compare their own progress accordingly.

AI Coding Gates in Practice: How Small and Midsize Teams Can Get Started

Kuaishou’s 415 rules and four lines of defense are built for a large organization. Small and midsize teams don’t need to copy them wholesale. The following suggestions are based on the reasoning in the source material; they aren’t Kuaishou’s conclusions and are offered for reference only.

The first step comes first deliberately: it costs almost nothing and directly addresses one of the hardest problems to spot—AI taking shortcuts. Here’s a minimal gate script that prevents checks from being skipped. It uses deterministic rules and doesn’t rely on a model:

import re, subprocess, sys

# Get the lines added in this commit
diff = subprocess.run(["git", "diff", "--cached", "-U0"],
                      capture_output=True, text=True).stdout
added = [l for l in diff.splitlines() if l.startswith("+") and not l.startswith("+++")]

BYPASS = [r"#\s*noqa", r"//\s*nolint", r"@SuppressWarnings", r"pytest\.mark\.skip", r"eslint-disable"]
hits = [l for l in added for p in BYPASS if re.search(p, l)]
if hits:
    print("门禁拦截：检测到新增的检查豁免\n" + "\n".join(hits))
    sys.exit(1)

You can implement the AI review in step four using any OpenAI-compatible API. The following example uses a small set of high-value team rules as a system prompt to review a diff:

import subprocess, openai

client = openai.OpenAI(
    api_key="YOUR_API_KEY",
    base_url="https://api.apiyi.com/v1"  # APIYI OpenAI-compatible API
)

RULES = """你是代码评审门禁。仅依据以下规则检查 diff,逐条输出违规项，无违规输出 PASS:
1. 不得删除带有 compat/legacy 注释的兼容代码
2. 新建线程池必须设置有界队列和最大线程数
3. 涉及用户数据的接口必须有鉴权校验"""

diff = subprocess.run(["git", "diff", "origin/main...HEAD"],
                      capture_output=True, text=True).stdout

resp = client.chat.completions.create(
    model="gpt-4o-mini",  # Can be replaced with another model to compare results
    messages=[{"role": "system", "content": RULES},
              {"role": "user", "content": diff[:60000]}],
    temperature=0,
)
print(resp.choices[0].message.content)

import json, subprocess, sys, openai

client = openai.OpenAI(
    api_key="YOUR_API_KEY",
    base_url="https://api.apiyi.com/v1"
)

def load_rules(path="ai_gate_rules.json"):
    """Rules file: [{"id": "PERF-01", "text": "..."}]"""
    with open(path, encoding="utf-8") as f:
        return json.load(f)

def review(diff: str, rules: list, model: str = "gpt-4o-mini") -> dict:
    rule_text = "\n".join(f"[{r['id']}] {r['text']}" for r in rules)
    prompt = ("仅依据下列规则审查 diff。以 JSON 返回 "
              '{"violations":[{"rule_id":"","line":"","reason":""}]},无违规返回空数组。\n'
              + rule_text)
    resp = client.chat.completions.create(
        model=model,
        messages=[{"role": "system", "content": prompt},
                  {"role": "user", "content": diff[:60000]}],
        temperature=0,
        response_format={"type": "json_object"},
    )
    result = json.loads(resp.choices[0].message.content)
    result["usage"] = resp.usage.total_tokens  # Record token usage for cost assessment
    return result

if __name__ == "__main__":
    diff = subprocess.run(["git", "diff", "origin/main...HEAD"],
                          capture_output=True, text=True).stdout
    if not diff.strip():
        sys.exit(0)
    result = review(diff, load_rules())
    print(json.dumps(result, ensure_ascii=False, indent=2))
    # Block on violations; consider logging results to track detection and false positive rates
    sys.exit(1 if result.get("violations") else 0)

It’s important to remember that model reviews can miss issues and produce false positives. They’re a supplement to deterministic checks and human code review, not a standalone gate.

🚀 Official recommendation: When setting up an AI review gate, start by comparing several models’ detection and false positive rates on the same set of historical PRs. With APIYI apiyi.com, you can use one API key to call models from OpenAI, Claude, Gemini, and others. Just change the model parameter to switch models. New users get free testing credits.

Impact Analysis of AI Coding Gates

Impact on Development Teams

• A shift in review priorities: As the proportion of AI-generated code grows, it becomes harder for humans to review every line. Teams need to shift their focus from “reading code” to “maintaining rules and gates.”
• Rules become assets: Business knowledge and lessons from incidents need to be captured as executable rules, rather than scattered across documents and retained in veteran employees’ heads.
• A new cost factor: The more rules and reviews there are, the higher the token consumption. Kuaishou specifically listed “token cost optimization requirements” among its deliverables, showing that this is already a real challenge at scale, though the actual costs haven’t been disclosed.

Impact on the Industry

• From competition over generation to competition over governance: Both Google’s Argon case and Kuaishou’s experience suggest that the next differentiator will be the ability to validate, review, and govern systems in production.
• Harness engineering: Packaging knowledge, constraints, tests, and feedback loops into an agent’s execution environment is becoming standard practice for enterprises adopting coding agents.
• False-positive management will be an ongoing challenge: As the number of rules grows, keeping them accurate and avoiding developer fatigue will be harder than writing the rules themselves.

💰 Cost tip: When evaluating token costs for AI review gates, start by tracking usage across a small set of repositories. APIYI apiyi.com offers usage-based billing and usage tracking, making it easier to estimate the cost of a full rollout.

Frequently Asked Questions

AI Coding Gates: Key Takeaways

• Generation is no longer the bottleneck: The share of AI-generated code at Kuaishou rose from 26% to 60% in one year, making validation the weak link.
• Five recurring failure modes: Missing business knowledge, historical governance context, and performance, security, and coding constraints.
• Turn constraints into gates: AI may skip checks to get code to compile, so suggestions in prompts aren’t enough.
• Manage knowledge and constraints separately: 37 knowledge rules prevent hallucinations, while 378 constraints enforce standards.
• Four layers of defense back each other up: Harness during coding, plugin safeguards, intelligent code review (CR), and ArchAgent in production.
• Test the rules themselves: A three-stage feedback loop—development, release approval, and retirement—keeps false negatives and false positives under control.
• Small teams can start with hard gates: First block attempts to skip checks, then experiment with AI review at low cost through APIYI apiyi.com.

Summary

Kuaishou’s session preview offers a clear framework for AI coding governance:

1. The problem: AI-generated code is growing faster than teams’ ability to validate it. Technical debt compounds, and production incidents have already occurred.
2. The methodology: Combine knowledge and constraints, embed them in the development workflow as Skills, and establish a quality feedback loop for the rules themselves.
3. The implementation: Use four layers of defense—coding, plugins, review, and production—with different paths depending on each team’s integration status.

For teams already using AI coding at scale, the five failure modes and four layers of defense in this article offer a starting point for checking where their gates provide coverage. The full results and implementation details will be worth following in the December presentation.

If you’re planning to try AI review at the PR stage, consider using APIYI apiyi.com to quickly compare review quality and token consumption across models before deciding how much to invest.

📚 References

1. InfoQ – Managing Incremental Risks in AI Coding: Skill Gates and Harness Implementation | AICon Beijing: The original preview of Kuaishou’s session
2. Link: infoq.cn/article/XieGrL5pws7jG1zxKPle

3. Details: Covers the proportion of AI-generated code, the scale of the rules, four lines of defense, and the presentation outline.

4. InfoQ – Google Uses Gemini 4 Argon to Optimize 200,000 Lines of ADK Code Overnight: A case study of a coding agent modifying an existing codebase

5. Link: infoq.cn/article/u4fAoAH5vZPCV4TVqAcO
6. Details: Shows agent output and human review rejection rates, supporting the point that “validation is the bottleneck.”

Author: APIYI Technical Team
Technical discussions: Visit the APIYI homepage at apiyi.com to contact us. For more integration resources, see the documentation at docs.apiyi.com.