The outcome

Standardize AI-assisted review while making its authority and evidence requirements explicit.

Step by step

A workflow you can repeat.

  1. 01

    Define the review scope, severity rubric, safe evidence, exact diagnostic commands, maximum steps, provider, and output schema.

  2. 02

    Create a project-scoped agent with read and search access while denying edits, broad shell, external directories, web tools, skills, MCP, and nested agents.

  3. 03

    Allowlist only necessary diagnostic commands and paths, keeping environment files, credentials, installation, Git writes, pushes, and deployments blocked.

  4. 04

    Test known defects, false positives, hostile comments, large diffs, generated files, missing dependencies, and requests to escape the permission boundary.

  5. 05

    Version the agent configuration, require file-and-line evidence, manually verify serious findings, and review the rules whenever Kilo or the repository changes.

Working standard

What good use looks like.

  • Deny editing and publishing.
  • Allowlist exact diagnostics.
  • Verify consequential findings manually.

Official references

Check the current product documentation.