AI Security Code Review Guide

Use this guide when you are reviewing a pull request, an integration, or an existing codebase for AI security mistakes. The goal is to check whether the implementation preserves trust boundaries, not only whether the prompts look reasonable.

Assumptions

You can inspect the orchestration code, tool definitions, and enforcement path.
You know which workflow or product surface the code is supposed to support.
Anthale is either already integrated or planned as part of the control flow.

Review the code

Map where untrusted content first enters

Find the code that accepts user input, retrieved text, uploaded files, OCR output, tool results, memory replay, or MCP responses. Mark where each of those sources first reaches model context.

Check Anthale boundary placement

Verify that Anthale runs before prompt assembly, before risky tool or retrieval output is reused, and before final model output leaves the workflow. Anthale should guard the boundary, not observe it after the fact.

Inspect tool and action gating

Review how tools are registered, what credentials they use, and whether arguments are validated against business rules before execution. A tool call should still be an application decision.

Inspect retrieval and memory writes

Check whether retrieved content and memory entries keep provenance, stay separate from higher-authority instructions, and are re-checked before replay.

Inspect output handling

Verify that redact uses sanitized content only, block stops the path, and structured or side-effecting outputs are validated before the next system consumes them.

Inspect logs and reviewability

Confirm that the code logs the Anthale action, the application enforcement result, and the boundary or source type that produced the event. If you cannot explain a failure later, the review is incomplete.

What this looks like in code

from os import environ

from anthale import Anthale

client = Anthale(api_key=environ["ANTHALE_API_KEY"])
RETRIEVAL_POLICY_ID = environ["ANTHALE_RETRIEVAL_POLICY_ID"]

def bad_prompt_assembly(user_input: str, retrieved_chunk: str) -> list[dict]:
return [
{"role": "system", "content": "You are a support agent."},
{"role": "user", "content": user_input},
{"role": "system", "content": f"Retrieved context:\n{retrieved_chunk}"},
]

def better_prompt_assembly(user_input: str, retrieved_chunk: str) -> list[dict]:
response = client.organizations.policies.enforce(
policy_identifier=RETRIEVAL_POLICY_ID,
direction="input",
messages=[{"role": "user", "content": retrieved_chunk}],
metadata={"boundary": "retrieval_ingestion", "feature": "support-agent"},
)
if response.action == "block":
raise RuntimeError("Anthale blocked the retrieved chunk.")

    safe_chunk = response.redacted_messages[0]["content"] if response.action == "redact" else retrieved_chunk
    return [
        {"role": "system", "content": "You are a support agent."},
        {"role": "user", "content": user_input},
        {"role": "system", "content": f"Retrieved context:\n{safe_chunk}"},
    ]

import Anthale from "anthale"

const client = new Anthale({ apiKey: process.env.ANTHALE_API_KEY })
const RETRIEVAL_POLICY_ID = process.env.ANTHALE_RETRIEVAL_POLICY_ID!

export function badPromptAssembly(userInput: string, retrievedChunk: string) {
  return [
    { role: "system", content: "You are a support agent." },
    { role: "user", content: userInput },
    { role: "system", content: `Retrieved context:\n${retrievedChunk}` },
  ]
}

export async function betterPromptAssembly(userInput: string, retrievedChunk: string) {
  const response = await client.organizations.policies.enforce(RETRIEVAL_POLICY_ID, {
    direction: "input",
    messages: [{ role: "user", content: retrievedChunk }],
    metadata: { boundary: "retrieval_ingestion", feature: "support-agent" },
  })

  if (response.action === "block") {
    throw new Error("Anthale blocked the retrieved chunk.")
  }

  const safeChunk = response.action === "redact" ? response.redacted_messages[0].content : retrievedChunk

  return [
    { role: "system", content: "You are a support agent." },
    { role: "user", content: userInput },
    { role: "system", content: `Retrieved context:\n${safeChunk}` },
  ]
}

The review question is simple: does Anthale run before the untrusted content becomes part of the prompt, or only after the damage is already done.

Common anti-patterns

Anthale is called after the prompt is already assembled or after a tool result is already trusted.
One global prompt is treated as the main security layer while permissions and approvals stay broad.
Tool arguments are schema-valid but still unsafe because destinations, records, or side effects are not allowlisted.
redact is returned, but the raw content is still logged, stored, or forwarded.
Memory or summaries are replayed without any source tagging or boundary check.

Next steps

Continue with Red-Team Agent Workflows, Log Security Events, or How Anthale Works.

Documentation

Quick Start

Learn

AI Security Code Review Guide

Assumptions

Review the code

What this looks like in code

Common anti-patterns

Next steps

​Assumptions

​Review the code

​What this looks like in code

​Common anti-patterns

​Related pages

​Next steps

Assumptions

Review the code

What this looks like in code

Common anti-patterns

Related pages

Next steps