AI-Assisted Backend Dev: Why Compiling Code Is Not Enough to Confirm It Works

A developer building FinanceHub's custom backend used an AI agent to write code task-by-task, guided by a strict contract-first approach where the OpenAPI spec and database schema were treated as fixed inputs. Despite code compiling cleanly and AI explanations sounding plausible, a mandatory 6-step verification process per task caught several critical bugs that automated tests missed. Key failures included Supabase JWTs being silently rejected due to an algorithm mismatch, a PATCH endpoint overwriting optional fields with null on partial updates, and 24 row-level security policies that were effectively dead code because the required schema-level GRANT permissions were never set. Each bug was only discovered because verification demanded real tokens, real partial payloads, and actual database permission checks — not synthetic stubs. The experience highlights that with AI-generated code, the central question shifts from 'does it work?' to 'how do I actually know it works?'