Reviewing what Joule wrote

SAP's recommendation is short and clear: all AI-generated development objects and code snippets must always be reviewed for functional and semantic correctness by human developers. SAP adds that the language models behind J4D can change at any point, so the same prompt can produce different results over time. Review isn't a courtesy. It's the control that makes AI-generated code shippable.

Four layers of review

Layer 1 and 2: let the tools do their part

For code in ZCMC_CLOUD, the ABAP for Cloud Development language version stops non-released APIs before ATC even runs. ATC then applies Contoso's ZCMC_CLOUD_DEV variant, where priority 1 and 2 findings block release (see sap-abp-204). For classic code in packages such as ZCMC_SD, ZCMC_CLASSIC_DEV blocks priority 1 and 2 on new findings. Generated code passes through exactly the same gate; don't create a softer path for it.

J4D can help here too. With SAP Note 3721223 applied, AI capabilities for ATC findings include explanations and code proposals for findings from the SAP S/4HANA custom code checks. A proposal is still generated code: review it like any other.

Layer 3: a review checklist for generated code

• Does it do what the requirement says, and only that? Generated code sometimes adds "helpful" behavior nobody asked for.
• Are names, keys and messages right? Check against the naming guide and the message class.
• Is error handling explicit? RAP validations must fill FAILED and REPORTED; no silent catches.
• Is authorization handled? Generated RAP code may skip authorization checks that your design requires.
• Are there hidden data reads? Look for SELECTs in loops and reads of full tables.
• Would a colleague understand it in a year? Clean up names and add ABAP Doc where the logic isn't obvious.

Clean core checks for generated code

SAP's clean core guidance rewards code that uses released APIs and avoids modifications. Generated code tends to copy whatever patterns it has seen, including classic patterns that are fine in classic packages but wrong in ABAP Cloud. Two practical checks: run ATC with your clean core classification variant (Contoso uses ZCMC_CLEAN_CORE, report only, monthly), and look at what a generated object depends on. A generated helper class that calls an unreleased function module drags your extension down a clean core level.

Who reviews, and when

At Contoso, every transport from ZCMC_CLOUD needs a second developer's review before the request is released, whether or not AI was involved. For AI-generated code Kenji added two rules. First, the reviewer reads the generated parts line by line, not just the diff summary. Second, the author marks generated sections in the review notes so the reviewer knows where to look hardest. Reviews happen in ADT: the reviewer opens the objects of the task, compares versions with the previous revision, runs the unit tests and ATC themselves, and records the result before the developer releases the request. Luis, as release manager, imports into CMQ only requests whose review record is complete.