Security-critical code and agent limits
A teammate wants to let an agent generate the core of a new authentication flow — token issuance, signature verification, session rotation, and the password-reset path — to move fast on a deadline. You're uneasy. Make the case for when you would and wouldn't let an AI agent own security-critical code like this, what specific failure modes make it the wrong tool here, and how you'd still use the agent without ceding the dangerous parts.
verify_auth_tokens(token_lines: list[str], pinned_alg: str, signing_secret: str, now_epoch: int) → list[str][["HS256|u1;admin|k1.u1;admin|2000","none|u1|k1.u1|2000","HS256|u1|bogus|2000","HS256|u1|k1.u1|1000"],"HS256","k1",1000]out["accept","reject_alg","reject_signature","reject_expired"][["HS256|u1|k1.u1|1001","RS256|u1|k1.u1|9999"],"HS256","k1",1000]out["accept","reject_alg"]Treat the AI’s output as a draft to verify, not an answer to trust. Name the specific flaw and the input that triggers it, say how you’d catch it (tests, edge cases, reading critically), and how you’d re-prompt or decompose to get it right.
Vibe & agentic: describe the solution in plain language (or narrate it) and the coach grades your approach.