Tools & Patterns
Practical, opinionated patterns for prompting, workflow design, evaluation, review, CI, and governance in agentic software projects.
Prompting for engineering tasks
Outcome-first task spec
Lead with the goal, acceptance criteria, and constraints. Reduces scope creep and hallucination.
Context-loading pattern
Inject architecture notes, coding standards, test strategy, and examples of good code before the task.
Anti-pattern: unbounded scope
Avoid open-ended requests like "refactor this file." Specify which smell, which change, how to verify.
Definition of done prompt
Always include what "done" looks like: tests pass, types check, no lint errors, PR description written.
Agentic workflow design
Reviewable-slice decomposition
Decompose features into tasks small enough that one agent run produces a reviewable, testable diff.
Human-in-the-loop placement
Place human approval gates before irreversible actions: deploys, deletes, external API calls, force pushes.
Checkpoint and rollback
Commit after each verified agent step. Never let an agent accumulate unreviewed changes across many steps.
Single-agent vs. multi-agent
Prefer single-agent loops for most tasks. Multi-agent adds orchestration complexity — use only when parallelism genuinely helps.
Evaluation and verification
AI output review checklist
Does it satisfy the requirement? Are tests meaningful? Is the design maintainable? Edge cases? Security? Architecture fit?
Test generation quality check
Verify generated tests have meaningful assertions, test the right behaviour, and fail when the code is wrong.
Hallucination detection heuristics
Watch for: invented API methods, confident wrong facts, tests that never assert, imports of non-existent packages.
Static analysis gate
Run type checker, linter, and security scanner on every agent-generated diff before human review.
CI/CD for agentic projects
Secrets scan on every push
Run Gitleaks or truffleHog in CI. Block merges if secrets are detected.
Required PR review for agentic branches
Protect main with required reviews. Even if an agent opened the PR, a human must approve before merge.
Dependency audit on install
Run npm audit / pip-audit / cargo audit in CI. Block on high-severity findings.
Agentic session metrics
Track defect rate, test coverage delta, and security findings per session. Alert on degradation trends.
Governance patterns
CLAUDE.md / repository instructions
Document coding standards, prohibited actions, approved tool list, architecture notes, and DoD in a file the agent reads at session start.
Tool allowlist template
Explicitly enumerate which tools, paths, and external calls the agent may use. Default to deny.
Incident response playbook
Pre-write the response steps for: agentic secret leak, bad code pushed, unintended external API call.
Audit log configuration
Log agent session ID, timestamp, tool calls, file reads, and outputs. Retain 90 days minimum. Make searchable.