The outcome

Find actionable defects without treating generated review comments as authoritative or exposing unnecessary code and secrets.

Amp is a cloud-connected AI coding agent for terminal and editor workflows. Running focused coding tasks in durable threads, applying repository guidance, reviewing changes, and using different reasoning modes from the terminal or editor. This guide narrows that broad capability into one repeatable outcome, with checkpoints that keep the source material and your judgment in the loop.

Before you begin

Set the boundary before the tool starts.

Choose one real task, identify who will use the result, and decide what evidence or test will make the result acceptable. Gather only the source material needed for that task. If the work contains confidential, personal, regulated, or client-owned information, confirm that the platform and account are approved before sharing it.

Troiana principle

AI should make the work easier to inspect. If the workflow removes the source, the owner, or the review step, redesign the workflow.

Step by step

A workflow you can repeat.

  1. 01

    Define the diff, threat model, quality bar, sensitive paths, and checks needed for correctness, security, performance, and maintainability.

  2. 02

    Inspect thread visibility and data policy, remove secrets from the workspace context, and run the review from a clean trusted checkout.

  3. 03

    Use Amp review and narrow repository checks, asking each finding to cite exact code, impact, reproduction evidence, and a minimal correction.

  4. 04

    Reproduce high-severity findings with trusted tests or manual analysis, reject unsupported claims, and ensure suggested fixes do not widen permissions or scope.

  5. 05

    Record accepted and dismissed findings, rerun the project checks after changes, and obtain the required human approval before merge or deployment.

Working standard

What good use looks like.

  • Verify every high-impact finding.
  • Keep thread sharing intentional.
  • Never paste credentials into review context.

Amp runs tools without asking by default, and thread data can include prompts, tool results, attachments, and selected code. Work in an isolated branch or environment, add custom permission controls for untrusted inputs, keep secrets out of context despite best-effort redaction, choose thread visibility deliberately, review workspace and administrator access, inspect every diff and command, and require human approval for pushes, deployments, migrations, or destructive actions.

Official references

Check the current product documentation.

Features, plan limits, availability, and data controls change. These official pages are the starting points used for this collection.