Use structured, specific prompts with clear context and requirements to achieve consistent, high-quality AI outputs.
Rationale
Dimension
Justification
Business Value
Better prompts reduce iterations and produce more usable outputs
Technical Foundation
AI output quality is directly proportional to prompt quality
Risk Mitigation
Vague prompts lead to incorrect assumptions and flawed implementations
Human Agency
Well-crafted prompts ensure AI operates within intended boundaries
Implications
flowchart LR
Context["Context<br/><i>Background, tech stack, existing code</i>"]
Requirement["Requirement<br/><i>What to do, specific, detailed</i>"]
Constraints["Constraints<br/><i>Boundaries, limitations, style rules</i>"]
Examples["Examples<br/><i>Show patterns, expected format, I/O</i>"]
Context --> Requirement --> Constraints --> Examples
Prompt Quality Comparison
❌ Poor
✅ Good
“Write a function for authentication”
“Write a function that: • Takes username (string) and password (string) • Validates against the user store • Returns { success: boolean, message: string } • Hashes password before comparison • Logs failed attempts • Uses existing auth.utils module”
Area
Implication
Development
Prompts include context, requirements, constraints, examples
Governance
Production prompts reviewed and version controlled
Skills
Prompt engineering included in training curriculum
Review AI-generated code with at least as much rigor as human-written code, using structured checklists for understanding, correctness, quality, and security.
Rationale
Dimension
Justification
Business Value
Reviews catch defects before they reach production
Technical Foundation
AI-generated code can contain subtle errors masked by correct syntax
Risk Mitigation
Security vulnerabilities and logic errors require human detection
Human Agency
Review ensures humans understand and can maintain generated code
Implications
Code Review Checklist
1. UNDERSTANDING - “Can I explain this code?”
✅ Check
Criteria
☐
Logic comprehension - Can I explain the algorithm?
☐
Pattern recognition - Do I recognize the patterns?
☐
Modification ability - Could I modify this if needed?
☐
Behavior prediction - Can I predict edge case behavior?
⚠️ IF ANY UNCHECKED: DO NOT APPROVE
2. CORRECTNESS - “Does it do what was requested?”
✅ Check
Criteria
☐
Functional correctness - Does the logic appear correct?
☐
Edge case handling - Are boundaries handled?
☐
Error handling - Are errors handled appropriately?
☐
Return values - Are returns correct and consistent?
3. QUALITY - “Does it meet standards?”
✅ Check
Criteria
☐
Style compliance - Follows project style guide?
☐
Naming clarity - Names clear and consistent?
☐
Complexity - Is there unnecessary complexity?
☐
Documentation - Comments where needed?
4. SECURITY - “Is it secure?”
✅ Check
Criteria
☐
Input validation - All inputs validated?
☐
Authentication/AuthZ - Proper access control?
☐
Data protection - Sensitive data handled correctly?
☐
Known vulnerabilities - No OWASP top 10 issues?
Area
Implication
Development
All AI-generated code reviewed using structured checklist
Governance
Review completion required before merge
Skills
Train reviewers on AI-specific review considerations
Tools
Integrate review checklists into code review tools
DM-001: Pipeline Integration (review as quality gate)
DC-004: Agentic Development
Statement
Deploy autonomous AI agents only for appropriate use cases with defined boundaries, human oversight points, and rollback capabilities.
Rationale
Dimension
Justification
Business Value
Agents accelerate repetitive tasks and large-scale changes
Technical Foundation
Agentic AI operates at L3 (partial automation) requiring oversight
Risk Mitigation
Unbounded agents can make widespread, difficult-to-reverse changes
Human Agency
Human defines boundaries; agent operates within; human approves results
Implications
Appropriate vs Inappropriate Use Cases
✅ Appropriate
❌ Inappropriate
Rapid prototyping
Production deploys
Multi-file refactor
Security-sensitive
Boilerplate generation
Complex business logic
Test generation
Compliance-critical
Documentation updates
Unsupervised runs
flowchart LR
subgraph Pre["Pre-Session"]
P1["☐ Define Scope"]
P2["☐ VCS Baseline"]
P3["☐ Backup Ready"]
end
subgraph During["During Session"]
D1["☐ Monitor"]
D2["☐ Intervene if needed"]
D3["☐ Create Checkpoints"]
end
subgraph Post["Post-Session"]
O1["☐ Review All Changes"]
O2["☐ Test Thoroughly"]
O3["☐ Approve or Rollback"]
end
Pre --> During --> Post
Control Mechanisms
Time limits on agent sessions
File/directory scope restrictions
Tool access limitations
Mandatory checkpoints
Rollback capability
Area
Implication
Development
Agent sessions have defined scope and supervision
Governance
Approval required for agent deployment; boundaries documented
Skills
Train developers on agent capabilities and limitations
Tools
Configure agent tools with appropriate restrictions
Maturity Alignment
Level
Requirements
Base (L1)
Agents for low-risk tasks only; constant human supervision
Medium (L2)
Defined use case catalog; checkpoint-based workflows
High (L3)
Broader autonomy for proven scenarios; automated guardrails
Governance
Compliance Measures
Agent use cases documented and approved
Scope boundaries defined before each session
Baseline committed before agent runs
Human review required for all agent output
Rollback tested and available
Exception Process
Condition
Approval Required
Documentation
Extended agent session
Tech Lead
Checkpoint schedule
Broader scope
Architect
Risk assessment
Production-adjacent
Director + Security
Isolation measures
Related Principles
TSI-003: Protocol Adoption (MCP/A2A for agent coordination)