> ## Documentation Index
> Fetch the complete documentation index at: https://anthale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# AI Security Code Review Guide

> Review AI agent, retrieval, tool, memory, and output code paths for trust-boundary mistakes, missing guardrails, and unsafe patterns before they ship.

Use this guide when you are reviewing a pull request, an integration, or an existing codebase for AI security mistakes. The goal is to check whether the implementation preserves trust boundaries, not only whether the prompts look reasonable.

## Assumptions

* You can inspect the orchestration code, tool definitions, and enforcement path.
* You know which workflow or product surface the code is supposed to support.
* Anthale is either already integrated or planned as part of the control flow.

## Review the code

<Steps>
  <Step title="Map where untrusted content first enters">
    Find the code that accepts user input, retrieved text, uploaded files, OCR output, tool results, memory replay, or
    MCP responses. Mark where each of those sources first reaches model context.
  </Step>

  <Step title="Check Anthale boundary placement">
    Verify that Anthale runs before prompt assembly, before risky tool or retrieval output is reused, and before final
    model output leaves the workflow. Anthale should guard the boundary, not observe it after the fact.
  </Step>

  <Step title="Inspect tool and action gating">
    Review how tools are registered, what credentials they use, and whether arguments are validated against business
    rules before execution. A tool call should still be an application decision.
  </Step>

  <Step title="Inspect retrieval and memory writes">
    Check whether retrieved content and memory entries keep provenance, stay separate from higher-authority
    instructions, and are re-checked before replay.
  </Step>

  <Step title="Inspect output handling">
    Verify that `redact` uses sanitized content only, `block` stops the path, and structured or side-effecting outputs
    are validated before the next system consumes them.
  </Step>

  <Step title="Inspect logs and reviewability">
    Confirm that the code logs the Anthale action, the application enforcement result, and the boundary or source type
    that produced the event. If you cannot explain a failure later, the review is incomplete.
  </Step>
</Steps>

## What this looks like in code

<CodeGroup>
  ```python title="Python" theme={null}
  from os import environ

  from anthale import Anthale

  client = Anthale(api_key=environ["ANTHALE_API_KEY"])
  RETRIEVAL_POLICY_ID = environ["ANTHALE_RETRIEVAL_POLICY_ID"]

  def bad_prompt_assembly(user_input: str, retrieved_chunk: str) -> list[dict]:
  return [
  {"role": "system", "content": "You are a support agent."},
  {"role": "user", "content": user_input},
  {"role": "system", "content": f"Retrieved context:\n{retrieved_chunk}"},
  ]

  def better_prompt_assembly(user_input: str, retrieved_chunk: str) -> list[dict]:
  response = client.organizations.policies.enforce(
  policy_identifier=RETRIEVAL_POLICY_ID,
  direction="input",
  messages=[{"role": "user", "content": retrieved_chunk}],
  metadata={"boundary": "retrieval_ingestion", "feature": "support-agent"},
  )
  if response.action == "block":
  raise RuntimeError("Anthale blocked the retrieved chunk.")

      safe_chunk = response.redacted_messages[0]["content"] if response.action == "redact" else retrieved_chunk
      return [
          {"role": "system", "content": "You are a support agent."},
          {"role": "user", "content": user_input},
          {"role": "system", "content": f"Retrieved context:\n{safe_chunk}"},
      ]

  ```

  ```text title="TypeScript" theme={null}
  import Anthale from "anthale"

  const client = new Anthale({ apiKey: process.env.ANTHALE_API_KEY })
  const RETRIEVAL_POLICY_ID = process.env.ANTHALE_RETRIEVAL_POLICY_ID!

  export function badPromptAssembly(userInput: string, retrievedChunk: string) {
    return [
      { role: "system", content: "You are a support agent." },
      { role: "user", content: userInput },
      { role: "system", content: `Retrieved context:\n${retrievedChunk}` },
    ]
  }

  export async function betterPromptAssembly(userInput: string, retrievedChunk: string) {
    const response = await client.organizations.policies.enforce(RETRIEVAL_POLICY_ID, {
      direction: "input",
      messages: [{ role: "user", content: retrievedChunk }],
      metadata: { boundary: "retrieval_ingestion", feature: "support-agent" },
    })

    if (response.action === "block") {
      throw new Error("Anthale blocked the retrieved chunk.")
    }

    const safeChunk = response.action === "redact" ? response.redacted_messages[0].content : retrievedChunk

    return [
      { role: "system", content: "You are a support agent." },
      { role: "user", content: userInput },
      { role: "system", content: `Retrieved context:\n${safeChunk}` },
    ]
  }
  ```
</CodeGroup>

The review question is simple: does Anthale run before the untrusted content becomes part of the prompt, or only after
the damage is already done.

## Common anti-patterns

* Anthale is called after the prompt is already assembled or after a tool result is already trusted.
* One global prompt is treated as the main security layer while permissions and approvals stay broad.
* Tool arguments are schema-valid but still unsafe because destinations, records, or side effects are not allowlisted.
* `redact` is returned, but the raw content is still logged, stored, or forwarded.
* Memory or summaries are replayed without any source tagging or boundary check.

## Related pages

* [Secure Agent Workflows](/docs/learn/secure-ai-systems/secure-agent-workflows)
* [Gate Tool Actions](/docs/learn/secure-ai-systems/gate-tool-actions)
* [Red-Team Agent Workflows](/docs/learn/secure-ai-systems/red-team-agent-workflows)

## Next steps

Continue with [Red-Team Agent Workflows](/docs/learn/secure-ai-systems/red-team-agent-workflows), [Log Security Events](/docs/learn/secure-ai-systems/log-security-events), or [How Anthale Works](/docs/how-anthale-works).