The Prompt I Use Before Letting AI Touch Production Code

The problem: AI wrote code that broke production

Last month, a junior engineer on my team asked an AI assistant to add a retry mechanism to our payment webhook. The AI generated a loop that looked correct in isolation, but it retried indefinitely on a specific 4xx error, causing duplicate charges. The fix took two hours and a rollback. The real issue wasn't the AI; it was that we let it work with no constraints.

AI coding tools are powerful, but they lack context: they don't know your error budget, your deployment process, or your team's coding standards. If you paste a vague request, you get a vague and often dangerous result. The solution is a rigorous prompt that forces the AI to show its work, stay within boundaries, and produce something you can actually review.

This article gives you a copy-paste prompt that I now use before letting any AI touch production code. It includes placeholders, a checklist, and a verification script. You'll also see how to integrate it into your workflow with concrete commands.

Before you start

This prompt works with any AI coding assistant that can read files and execute commands, such as Claude Code, GitHub Copilot, or Cursor. You'll need a terminal, a Git repository, and the ability to run tests.

The prompt is designed for tasks that modify existing code, not for greenfield projects. If you're asking the AI to write a new service from scratch, adapt the context section to include your stack and conventions.

git checkout -b ai-generated-change
npm test

• Use a separate branch for AI-generated changes.
• Ensure your test suite runs locally before you start.
• Set environment variables for any API keys the AI might need to test with.
• Have a rollback plan: know the commit hash or tag to revert to.

Step 1: The prompt template

Copy the template below into your AI tool. Replace the placeholders in square brackets with your specific task details. The prompt is structured to force the AI to ask questions, propose a plan, and then implement with guardrails.

The key sections are: context, constraints, output format, and verification. Each one is non-negotiable. If the AI tries to skip a step, stop and restart with the full prompt.

You are modifying production code in the repository at [repo path]. 

Task: [describe the change, e.g., 'Add exponential backoff to the payment webhook retry logic'].

Context: 
- Language/framework: [e.g., 'Node.js 20, Express 4']
- Relevant files: [e.g., 'src/webhook.js', 'src/config.js']
- Existing tests: [e.g., 'tests/webhook.test.js']
- Deployment process: [e.g., 'CI runs npm test and npm run lint on every PR']

Constraints:
- Do not modify any files outside the ones listed unless absolutely necessary; if you do, explain why.
- Preserve existing error handling and logging patterns.
- Do not introduce new dependencies without asking first.
- Follow the project's style guide (e.g., StandardJS, Prettier).
- All new code must be covered by unit tests.
- Ensure backward compatibility with the existing API.

Output format:
1. First, list any clarifying questions you have about the task. Do not proceed until I answer them.
2. Then, propose a step-by-step implementation plan. I will approve it before you write any code.
3. After approval, implement the changes and run the existing test suite.
4. Finally, show a diff of your changes and explain how each part addresses the task.

Verification:
- Run the full test suite and report the results.
- Run the linter and fix any issues.
- If there are integration tests, run them as well.
- Provide a summary of any risks or edge cases you identified.

Step 2: Run the prompt with a real task

Let's test the prompt with a concrete example. Suppose we need to add a timeout to an HTTP client in a Node.js service. I'll show you the exact commands and the AI's expected behavior.

First, create a minimal project structure so we can reproduce this. Then run the prompt in your AI tool.

mkdir ai-demo && cd ai-demo
npm init -y
npm install express node-fetch@2
mkdir src tests
cat > src/client.js <<'EOF'
const fetch = require('node-fetch');

async function getData(url) {
  const res = await fetch(url);
  if (!res.ok) throw new Error(`HTTP ${res.status}`);
  return res.json();
}

module.exports = { getData };
EOF
cat > tests/client.test.js <<'EOF'
const { getData } = require('../src/client');

test('fetches data', async () => {
  const data = await getData('https://jsonplaceholder.typicode.com/todos/1');
  expect(data.id).toBe(1);
});
EOF
npm test

Step 3: The AI's response and your review

When you run the prompt with the task 'Add a 5-second timeout to the fetch call in src/client.js', the AI should first ask if you want to use AbortController or a library like node-fetch's built-in timeout. It should then propose a plan, get your approval, and implement.

Here's an example of the kind of diff the AI might produce after your approval. Notice that it adds a timeout parameter and uses AbortController, which is the standard approach in Node.js.

diff --git a/src/client.js b/src/client.js
index 1234567..89abcde 100644
--- a/src/client.js
+++ b/src/client.js
@@ -1,10 +1,16 @@
 const fetch = require('node-fetch');
 
-async function getData(url) {
-  const res = await fetch(url);
-  if (!res.ok) throw new Error(`HTTP ${res.status}`);
-  return res.json();
+async function getData(url, timeout = 5000) {
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), timeout);
+  try {
+    const res = await fetch(url, { signal: controller.signal });
+    if (!res.ok) throw new Error(`HTTP ${res.status}`);
+    return res.json();
+  } finally {
+    clearTimeout(timer);
+  }
 }
 
 module.exports = { getData };

Step 4: Verify with a test script

Before you merge, run a quick verification script that tests the timeout behavior. This catches cases where the AI's code might hang or throw unhandled errors.

Create a test that expects a timeout error when the server is slow. Then run the full suite.

// tests/timeout.test.js
const { getData } = require('../src/client');

test('throws on timeout', async () => {
  const slowServer = (req, res) => setTimeout(() => res.end('ok'), 10000);
  const server = require('http').createServer(slowServer).listen(0);
  const url = `http://localhost:${server.address().port}`;
  await expect(getData(url, 100)).rejects.toThrow('aborted');
  server.close();
});

npm test

Step 5: Use a safety checklist before merging

Even with the prompt, you must do your own review. Use this checklist before merging any AI-generated code.

This list is not exhaustive, but it covers the most common failure points I've seen.

git diff --check
npm audit --omit=dev
npm run lint

• Check for hardcoded secrets or credentials in the diff.
• Verify that error handling doesn't swallow exceptions silently.
• Ensure that timeouts and retries have upper bounds.
• Check that new dependencies are pinned and have no known vulnerabilities (npm audit).
• Run the full test suite and lint locally, not just in CI.
• Inspect the diff for changes outside the scope of the task.
• Confirm that the AI's code follows your team's logging and observability conventions.

What I would do: recommended setup

If you adopt this prompt, I recommend saving it as a template in your repository. That way, every developer on the team uses the same guardrails.

Create a file called .ai-prompt.md in the root of your repo with the template. Then, in your AI tool, you can reference it with a command like 'Use the prompt in .ai-prompt.md for this task'.

cat > .ai-prompt.md <<'EOF'
You are modifying production code in the repository at [repo path].

Task: [describe the change]

Context:
- Language/framework: [e.g., 'Node.js 20, Express 4']
- Relevant files: [e.g., 'src/webhook.js', 'src/config.js']
- Existing tests: [e.g., 'tests/webhook.test.js']
- Deployment process: [e.g., 'CI runs npm test and npm run lint on every PR']

Constraints:
- Do not modify any files outside the ones listed unless absolutely necessary; if you do, explain why.
- Preserve existing error handling and logging patterns.
- Do not introduce new dependencies without asking first.
- Follow the project's style guide (e.g., StandardJS, Prettier).
- All new code must be covered by unit tests.
- Ensure backward compatibility with the existing API.

Output format:
1. First, list any clarifying questions you have about the task. Do not proceed until I answer them.
2. Then, propose a step-by-step implementation plan. I will approve it before you write any code.
3. After approval, implement the changes and run the existing test suite.
4. Finally, show a diff of your changes and explain how each part addresses the task.

Verification:
- Run the full test suite and report the results.
- Run the linter and fix any issues.
- If there are integration tests, run them as well.
- Provide a summary of any risks or edge cases you identified.
EOF

Troubleshooting

If the AI ignores the prompt, here are common issues and how to fix them.

• The AI asks no clarifying questions: re-run the prompt and explicitly say 'You must ask at least one clarifying question before proposing a plan.'
• The AI modifies files outside your list: use git diff to identify them and revert with git checkout -- <file>.
• The AI introduces a dependency without asking: if not approved, remove it and re-run with a stricter constraint.
• Tests fail after the AI's changes: ask the AI to fix the tests, but verify the fixes don't weaken the assertions.
• The AI's plan is too vague: ask for a numbered step list with file names and specific functions to change.

FAQ

Answers to the questions that come up most often on this topic.

• Q: Can I use this prompt with ChatGPT or Claude? A: Yes, as long as the tool can access your repository and run commands.
• Q: What if the task is too large for one prompt? A: Break it into smaller tasks and run the prompt for each.
• Q: Should I use this for non-production code? A: It's overkill for throwaway scripts, but it's a good habit.
• Q: How do I handle the AI's clarifying questions? A: Answer them directly; the prompt is designed to make the AI ask only what it truly needs.
• Q: What if the AI doesn't follow the output format? A: Restart the conversation and paste the prompt again, emphasizing the format.

Your next action

The next time you ask an AI to change production code, use this prompt. Save it as a template in your repo, run it on a branch, and verify with the checklist. The first time will feel slow, but it's faster than a rollback.

Start with a small, low-risk change to practice. Then apply it to larger tasks. Your future self will thank you.