Bind test services to loopback
Use 127.0.0.1 for local container demonstrations instead of exposing them on every network interface.
Read full adviceTips
25Tips
Capture narrow evidence
Make screenshots support a specific timestamped claim and remove information a reviewer does not need.
Read full adviceCount non-model work
Include retrieval, tools, retries, storage, and review when analyzing request cost.
Read full adviceDate cost assumptions
Preserve the rate source and date used in any cost estimate.
Read full adviceGive tools least privilege
Limit each connection to the permissions required for its bounded task.
Read full adviceInspect before deleting storage
Confirm a named volume and its metadata before removing it.
Read full adviceKeep a route rollback reference
Before you switch the AI model or provider an app uses, write down the current setting so you can switch back.
Read full adviceKeep evaluation cases fixed
Use the same representative cases across prompt revisions so regressions remain visible.
Read full adviceKeep external content separate
Label retrieved or external text as untrusted data and do not let it redefine the task.
Read full adviceKeep first build contexts empty
Use an empty course folder and no COPY instruction to avoid packaging local files or secrets.
Read full adviceKeep historical claims time-bounded
Return unknown when no authorized claim covers the requested date instead of extending the nearest record.
Read full adviceKeep provider secrets behind the gateway
Clients should receive access only to approved routes, not broad provider credentials.
Read full adviceLabel memory evidence and uncertainty
Before an AI assistant keeps a fact, record why, where it came from, how sure you are, who may use it, and when it goes.
Read full adviceMake output requirements observable
Specify a concrete format and limits so a reviewer or system can inspect the result.
Read full adviceName one primary task
State one bounded transformation rather than leaving the model to choose the job.
Read full adviceRecord image digests
Use an image digest to preserve the exact content received rather than relying only on a tag.
Read full adviceReview generated YAML before reuse
Treat Podman-generated Kubernetes YAML as a local-state artifact, not proof of production readiness.
Read full adviceSeparate facts from assumptions in handoffs
Give the next worker verified state, open work, authority limits, and an observable completion check.
Read full adviceSet eval criteria before testing
Write observable pass conditions before reviewing a model response.
Read full adviceTest a denied path
Verify that an unauthorized identity is denied before using real material or broadening access.
Read full adviceTreat content as data, not authority
A document instruction does not gain permission to change policy, access data, or invoke a tool.
Read full adviceUse exact model identifiers
Record an official model identifier instead of relying on a remembered family name or alias.
Read full adviceUse the right diagnostic view
Use logs for main-process output, inspect for configuration and state, and a terminal for a deliberate in-container command.
Read full adviceUse the smallest permitted context
Include only relevant, authorized, current material needed to answer the bounded question.
Read full adviceVerify the Kubernetes context first
Check the active context and node readiness before applying any manifest.
Read full advice