AI-Assisted Coding: A Workflow and Best Practices

Step 1: Plan before you prompt

Decide what you are building and how you will know it works. Break the task into small steps. Smaller, well-defined requests produce better code and are far easier to review than one request for a whole feature.

Goal: add rate limiting to the /login endpoint.
Steps: 1) choose the approach, 2) implement, 3) add tests, 4) update docs.
Done when: more than 5 attempts per minute from one IP returns HTTP 429.

Step 2: Give the assistant the right context

Include the relevant files, the language and framework versions, your conventions, and examples of existing code in the same style. State constraints such as no new dependencies and the performance or security requirements.

Step 3: Review like a code reviewer

Read every line before accepting it. Check that it solves the actual problem, matches your architecture, handles errors and edge cases, and does not invent functions or libraries that do not exist. Ask the assistant to explain anything you do not understand.

Step 4: Make tests your safety net

Write or generate tests, then run them. A test you understand is worth more than confident-sounding code. Ask for tests of edge cases, and make sure the tests fail when the code is wrong rather than only passing.

Write pytest tests for rate_limit(), including: exactly at the limit,
one over the limit, a different IP, and the window resetting.

Step 5: Protect security, secrets, and licensing

Never paste secrets or private keys into prompts, and run security scanners and dependency checks on generated code. Watch for insecure patterns such as unsanitized input, hard-coded credentials, and outdated cryptography. Follow your organization's policy on code licensing and which tools may see your source code.