The Whiteboard Defense

Mitchell Hashimoto, the HashiCorp co-founder, has a benchmark for responsible AI use. He calls it the whiteboard defense.⠀

At any moment, he can ask you to explain a customer-facing system you've shipped. He doesn't expect you to remember the function names or explain every line of AI-generated code, but you should be able to say why you chose X over Y, what happens when someone acts maliciously, and where it fails.⠀

Prototypes and demos are exempt. The bar is for what reaches customers.⠀

I think this matters more every month.⠀

I've been thinking about this a lot while building totalHOA, an HOA management platform I started over two years ago and continue to develop while looking for my next role.

The way I build it has changed dramatically in that time. Claude Code now writes most of the code, and I often have several agents working on different features at once. A feature that used to take weeks can now take hours.⠀

But that speed comes with a tradeoff. When I wrote everything myself, I gained an understanding of the system just by building it. Now I have to be much more intentional about that understanding, because when software gets built this fast, the bottleneck isnt writing code. Its understanding the decisions inside it.⠀

The agents do the typing. The decisions stay with me.⠀

Take the newest feature I've been building for totalHOA. It's a vendor management feature reads vendor contracts, insurance certificates, and bids, helping volunteer HOA boards compare quotes from different vendors. For example, a board might need to evaluate three roofing proposals side by side.⠀

Why not let AI pick the winner? Because the board ultimately has to defend that decision to its owners. AI reads the documents, traditional code handles the calculations, and a person reviews and confirms the results.⠀

Theres also the question of what happens when a vendor includes malicious instructions in a document. The AI can suggest information, but it cant make decisions or take actions on its own. Everything requires human confirmation.⠀

And what about the places where AI struggles, like reading a poorly scanned document? Every extracted number is tied back to its source page and the exact wording it came from, so someone can verify it rather than simply trust the output.⠀

I couldn't tell you every function name or walk through every line of code the agents have written.⠀

But I can tell you how the system works, why the decisions were made, and where things could go wrong. And I think thats becoming one of the most important responsibilities we have as engineers working with AI.