This section defines how we design, test, and govern prompts for AI-assisted workflows. Prompts are treated as infrastructure-as-text — versioned, peer-reviewed, and subject to the same quality and security controls as code.
Purpose
Prompt engineering provides structured, reproducible AI interactions for DevSecOps, infrastructure automation, and documentation pipelines.Reproducibility
Build a versioned prompt library for consistent results
Security
Secure-by-default design: no data leakage or secrets exposure
Quality
Peer-reviewed patterns for clarity and reusability
Goals
Reproducible Library
Build a versioned prompt library for code, documentation, and automation use cases
Folder Structure
Folder Purposes
| Folder | Description |
|---|---|
| library/ | Production-ready prompts reviewed and approved for use in workflows and automation pipelines |
| guides/ | Walkthroughs explaining prompt-design techniques, testing methods, and quality assurance |
| templates/ | Standard templates and governance checklists for new prompt submissions |
| examples/ | Example prompts and workflows showing chaining, RAG, or evaluation setups |
Prompt Card Specification
Every prompt file must include YAML frontmatter at the top followed by markdown content.Required Frontmatter Fields
| Field | Purpose |
|---|---|
title | Human-readable title of the prompt |
id | Unique identifier (<topic>-<purpose>-vX) |
intent | Short summary of what the prompt achieves |
tags | Searchable keywords (e.g. terraform, security, ci/cd) |
author / owner | Who wrote and maintains it |
model | Model family tested against (e.g. gpt-5, claude-3) |
temperature / max_tokens | Key model parameters |
version | Semantic version of the prompt |
last_reviewed | ISO date of last validation |
safety_reviewed | true or false — must be true for production use |
Security & Compliance Guidelines
Prompt engineering follows the same rules as code and infrastructure. Security is non-negotiable.
Security Checklist
No Secrets or Real Data
Never embed secrets, credentials, or real data in prompt examples. Use
<PLACEHOLDER> or <REDACTED> markers.Avoid PII and Internal Identifiers
No personal information, internal hostnames, or system identifiers in prompts.
No Data Exfiltration
Prompts should never query live environments or exfiltrate data to external systems.
Review for Correctness
Test every prompt for:
- Output correctness and determinism
- Data handling (no unintended exposure)
- Bias and tone alignment
- Model-agnostic performance
Prompt Templates
Two key templates are provided:Safety Checklist
Comprehensive security and compliance verification for all prompts. Covers secrets, PII, data handling, and ethical review.
Ruthless Mentor
Stress-test ideas with brutally honest critique. Designed to find flaws and strengthen reasoning before public review.
Safety Checklist Highlights
Security Controls (Required)
Security Controls (Required)
- ✅ No hard-coded secrets, keys, or tokens
- ✅ No real hostnames, IPs, or infrastructure identifiers
- ✅ No personal or sensitive data in examples
- ✅ Prompts do not request or encourage data exfiltration
- ✅ Output handling is deterministic and bias-free
- ✅ Example inputs contain only sanitized data
Compliance & Governance (Required)
Compliance & Governance (Required)
- ✅ Aligns with Cyber Essentials+ and NIST 800-53 confidentiality principles
- ✅ Supports least-privilege and minimal disclosure design
- ✅ No vendor lock-in or proprietary data dependencies
- ✅ Language and tone appropriate for workplace/public use
- ✅ Complies with ethical AI guidelines
Functional Validation
Functional Validation
- ⚙️ Runs successfully in test harness
- ✅ Outputs match expected structure
- ✅ Determinism validated for low-temperature prompts
- ⚙️ Stress-tested with edge cases
- ✅ Version incremented after material changes
Ruthless Mentor Template
Purpose
Purpose
Activates a ruthless mentor persona for brutally honest, high-signal critique of ideas, plans, or arguments.Use when:
- Finding flaws, weak assumptions, or logical gaps
- Preparing for critical reviews or public scrutiny
- Refining strategy or technical plans that must be airtight
Instruction
Instruction
Output Structure
Output Structure
The model responds with:
Example Use Case
Example Use Case
Input:Output:
- Critique: Weak differentiation, saturated market, unrealistic timeline
- Fixes: Narrow to niche (e.g., NHS supply-chain SMEs), build credibility first, create staged roadmap
- Bulletproof Version: “Launch lean Cyber Essentials+ automation for healthcare suppliers. Phase 1: content + pilots. Phase 2: recurring compliance reports. Phase 3: managed service.”
Workflow Integration
Best Practices
Design Principles
Explicit Intent
Clearly state what the prompt should achieve and what constitutes success
Structured Output
Define expected output format (JSON, markdown sections, etc.)
Model Agnostic
Test across multiple model families when possible
Deterministic
Use low temperature (0.1-0.3) for reproducible results
Testing & Validation
- Test with edge cases and invalid inputs
- Validate output format consistency
- Measure determinism across multiple runs
- Document model-specific quirks in prompt card
Version Control
Treat prompts like code:
- Use semantic versioning (v1.0, v1.1, v2.0)
- Increment version on material changes
- Maintain changelog in prompt card
- Tag and release stable versions
Resources
- Safety Checklist:
templates/safety-checklist.md - Prompt Card Template:
templates/prompt-card-template.md - Ruthless Mentor Template:
templates/brutally-honest-feedbackup-template.md