Decide whether to ship AI-written token checks

A teammate wants to merge an AI-written module for your Rust API. It verifies JWTs, the signed tokens that carry a user's identity, and rotates refresh tokens. It parses each token itself, checks the signature with a hand-written HMAC comparison and handles rotation with its own database logic. It passes all the tests.

Their argument: "The model knows crypto better than we do."

Do you ship it? Make the call and justify it.