Chapter 42
42 / 50

PR Review Methodology

⏱️ 20 min

Why Multi-Role Review?

Single-perspective code reviews miss things. By simulating multiple roles during review, you get a much more complete assessment of the change's quality and impact.

Review Roles

1. Product Manager Review

Look at the change from a product angle:

  • Business Value: Does this deliver promised value?
  • User Experience: Will users benefit from this change?
  • Strategic Alignment: Does it align with product goals?
  • Feature Completeness: Are all requirements met?
  • Action: Provide directives for maximum impact

2. Developer Review

Look at code quality from an engineer's perspective:

  • Code Quality: Is code clean and maintainable?
  • Standards: Does it follow coding conventions?
  • Performance: Are there efficiency concerns?
  • Scalability: Will it handle growth?
  • Refactoring: Any code that needs improvement?
  • Action: Suggest specific code improvements

3. Quality Engineer Review

Look at quality assurance from a testing angle:

  • Test Coverage: Are all paths tested?
  • Edge Cases: Are boundary conditions handled?
  • Regression Risk: Could this break existing features?
  • Test Quality: Are tests comprehensive and clear?
  • Action: Identify missing tests and scenarios

4. Security Engineer Review

Look at potential risks from a security angle:

  • Vulnerabilities: Any security risks?
  • Data Handling: Is sensitive data protected?
  • Authentication: Are auth checks proper?
  • Input Validation: Is user input sanitized?
  • Compliance: Does it meet security standards?
  • Action: Flag security concerns immediately

5. DevOps Review

Look at deployment and monitoring from an ops angle:

  • CI/CD Integration: Will builds succeed?
  • Configuration: Are configs properly managed?
  • Infrastructure: Any deployment concerns?
  • Monitoring: Are metrics and logs adequate?
  • Rollback: Can changes be safely reverted?
  • Action: Ensure smooth deployment

6. UI/UX Designer Review

Look at the interface from a user experience angle:

  • Visual Consistency: Does it match design system?
  • Usability: Is it intuitive to use?
  • Accessibility: Is it accessible to all users?
  • Responsive: Does it work on all devices?
  • Polish: Any rough edges to smooth?
  • Action: Ensure delightful user experience

Review Process

Standardized review workflow:

  1. Read PR description and linked issues

    • Understand the context and purpose of the change
  2. Review code changes systematically

    • Go file by file, pay attention to context
  3. Test functionality locally if applicable

    • Actually run it and verify
  4. Consider each perspective above

    • Walk through each role's lens
  5. Leave constructive feedback

    • Provide specific, actionable suggestions
  6. Approve or request changes

    • Make a clear approval decision

Key Principle

Improvements scheduled for "later" must be addressed NOW!

Don't let "we'll fix it later" become a tech debt excuse.

Practical Tips

Review Checklist Template

## PR Review: [PR Title]

### Product Perspective

-   [ ] Business value delivered
-   [ ] Requirements met
-   [ ] User experience considered

### Developer Perspective

-   [ ] Code is clean and readable
-   [ ] Follows coding standards
-   [ ] No obvious performance issues

### QA Perspective

-   [ ] Test coverage adequate
-   [ ] Edge cases handled
-   [ ] No regression risks

### Security Perspective

-   [ ] No security vulnerabilities
-   [ ] Input properly validated
-   [ ] Sensitive data protected

### DevOps Perspective

-   [ ] CI/CD compatible
-   [ ] Monitoring in place
-   [ ] Rollback possible

### UX Perspective

-   [ ] Consistent with design system
-   [ ] Accessible
-   [ ] Responsive

Using AI to Help Review

You can have AI review code from different role perspectives:

Review this PR from the following roles:
1. Product Manager - focus on business value
2. Security Engineer - focus on security risks
3. QA Engineer - focus on test coverage

[Paste PR code or link]

Next Steps

Check out Code Analysis Options to learn more code quality analysis techniques.

📚 Related resources

Common questions

Open a question to review the practical answer.

Why is single-perspective code review insufficient?

Pure developer view easily misses four risk classes: (1) business value and strategic alignment (PM lens); (2) edge cases and regression risk (QA lens); (3) input validation and sensitive data protection (Security lens); (4) CI/CD compatibility, rollback, monitoring (DevOps lens). Multi-role review is not bureaucratic overhead — it is the mechanism that surfaces those latent risks explicitly.

What review roles does the chapter define and what does each look at?

Six: (1) PM — Business Value / UX / Strategic Alignment; (2) Developer — Code Quality / Standards / Performance / Refactoring; (3) QA — Test Coverage / Edge Cases / Regression Risk; (4) Security — Vulnerabilities / Auth / Input Validation / Compliance; (5) DevOps — CI/CD / Config / Monitoring / Rollback; (6) UI/UX Designer — Visual Consistency / Usability / Accessibility / Responsive.

Why is "we'll fix it later" the most dangerous review reply?

The chapter's Key Principle states it bluntly: improvements scheduled for "later" must be addressed NOW. "Later" is a synonym for tech debt — once the PR merges without the fix, the fix essentially never happens. Requesting changes on the spot is an order of magnitude more effective than filing a new issue: issues live for weeks or months on average, while feedback inside a PR closes within 24 hours.

How do I prompt AI to review a PR from multiple roles?

The chapter gives the prompt directly: "Review this PR from these roles: 1. Product Manager — focus on business value; 2. Security Engineer — focus on security risks; 3. QA Engineer — focus on test coverage", then paste the diff or link. Pick the 2-3 most relevant roles per round rather than all six — more roles produce generic output, while 2-3 targeted ones yield concrete, actionable feedback.

How long should a PR review checklist template be?

The chapter template gives 3 checkboxes per role, 18 in total across six roles. The point is not the count but that every item is genuinely checkable — "Test coverage adequate" is, "Code is good" is not. Past 20 items nobody reads carefully, so every line must map to a concrete behaviour: CI/CD compatible, Input properly validated, Responsive on mobile; delete vague entries like "Quality is high".