Quick start (5-minute summary)

What this guide is: a working reference for engineers who direct AI agents, and for the staff engineers who set how their teams do it.

The core loop:

PROMPT → REVIEW → SECURE → REDUCE → TEST → SHIP

Your role: director of agents

• You decide and set constraints. Agents implement
• You review every diff before it leaves your machine
• You own quality, security, and operability of what ships

Tools that belong in every setup:

Prompting rule: specific beats long

GOOD:  "Add logout button to navbar, redirect to /login"
BAD:   "I need you to add a logout button..."  (wordy)

GOOD:  "Fix null check in getUserById"
BAD:   "Fix the auth system"  (no finish line)

Example workflow:

# 1. Isolate the work
git worktree add ../myapp-feature -b feature/user-auth

# 2. Start the agent in that worktree
cd ../myapp-feature && claude

# 3. Give intent, constraints, and a finish line
> "Add JWT auth middleware. Follow src/middleware/ patterns. Use the existing User
   model. Refresh token rotation. Done when auth tests pass and no new deps."

# 4. Review the diff
> "/review"

# 5. Reduce
> "Simplify the middleware. Remove duplication."

# 6. Security check
> "/security-review"

# 7. Test
> "Write tests for the auth middleware, then run them"

# 8. Ship
> "Create a PR with a summary and a test plan"

Golden rules:

1. Never ship unreviewed AI code
2. AI writes it, you own it
3. Anything a tool can enforce goes in a tool, not a prompt
4. Security review is mandatory for auth, payments, and user data
5. Run /clear between tasks. Keep durable context in files
6. Less code is the goal, not a side effect

Rolling it out to a team: turn this loop into a repo template (worktree script, review and security commands, PR template), then walk each new hire through it on a real ticket in week one.