Body
The world of AI tools for developers is rapidly changing. Vendors and platforms are releasing their own assistants and protocols almost quarterly, making it hard to find new features in product roadmaps or at industry conferences that don't involve AI. New tools emerge and fade; there is always the NEXT AI tool that promises the end of coding, or a study that either states AI threatens developers' productivity or enhances it by 10x to 1,000x.
The purpose of this article is not to highlight every tool a developer should use, or even document a particular tool's use. The landscape is constantly changing, and depending on the scope and business needs of projects, the tools will differ from team to team, project to project.
However, there are core principles we can apply to projects to ensure we are using the right tool, building the right thing, and producing the right product that is useful in the hands of those we serve, whether it be students, faculty, staff, or the wider community. Learning how to use AI and teaching our student employees how to apply best practices are critical for the future of development, software engineering, and operations.
Follow St. Thomas guidelines and policies on the use of AI
Do not provide secrets, sensitive, or proprietary data to AI without proper authorization from St. Thomas, which may require an enterprise license and an NDA (Non-Disclosure Agreement) with the vendor.
This includes datasets, analytics, authentication credentials, API or encryption keys, and other secrets. (You should NEVER store secrets in your code, even when not using AI! Use a secure solution like AWS SSM Parameter Store or Secrets Manager to handle API keys.)
Refer to the St. Thomas Data Classification Policy. Data classified as Yellow, Orange, or Red should not be shared with AI systems without proper authorization.
Establish firm guardrails with the AI tool you use, either in the prompt or contextual documents. Do not give it privileged access, monitor and review what is it doing, and use steering or rule documents to limit what it can do, how it should approach solutions, and when it should pause or stop and ask clarifying questions.
Documentation and context files are core features of your project
When working on an existing project or starting a new one, it is vital to understand not only the codebase but also coding standards, logging formats, architectural patterns, and the shared libraries, styles, and cloud infrastructure guidelines used at St. Thomas.
Without proper documentation or context, AI may suggest approaches that do not align with existing governance and maintenance practices.
Ensure your code is documented correctly, that your repository includes a well-structured README file, and that you include an AI Context file (AGENTS.md) and/or Kiro Steering documents to help the AI understand our environment and the application.
Also, ensure that the package and library names you include in your project are real and correct, beware of "slopsquatting" and ensure that suggested versions aren't deprecated.
These documents are not only AI-readable, but also Human-readable and will assist future AI and Human developers alike.
Kiro uses Specs and Steering documents to understand and work within the application, team, and organization context, making it an ideal choice for development at St. Thomas. When these documents are present and well-structured, AI-assisted development integrates well with established workflows.
Requirements and testing are essential from the start
Use a spec-driven approach when starting code from scratch. Instead of jumping into the AI chat, take a moment to outline all the requirements, including the standards, libraries, and governance.
For very large projects, it is vital to take a modularized approach, where each module is created one by one, verified, and then integrated into the project.
- Always begin by ensuring tests and documentation are up-to date!
- Generate any context or steering documents necessary to help understand the framework and the guardrails for working within it.
- AI can assist with these primary steps!
Make sure unit testing generation is part of your development process. You may even take a Test-Driven Development approach, writing tests first and then developing the code to achieve the desired outcome.
Use the tool tailored to the platform
When developing a workload that will run on AWS, use Kiro, AWS MCP Servers, and the CloudFormation language server.
Kiro can be used for more than AWS resources; it can also be used to develop React, Vue, or JavaScript/CSS, whether or not it is deployed to AWS.
You may ask for suggestions in a web-based chat, such as ChatGPT or Google, but for all practical development purposes, use an AI assistant integrated into VS Code (or another IDE such as Kiro) so it can review the code and the context of your project.
Note that AI tools may not be aware of specialized development and deployment environments provided by vendor platforms such as Unily (OST) or Ellucian Extensions (Murphy), and may provide limited usefulness for vendor platform-specific libraries that do not have a public repository (it may be helpful to provide context in the prompt).
As St. Thomas implements Kiro IDE and CLI for cloud operations and development across teams, it will become the enterprise solution.
Be skeptical and ask questions
You don't need to be overly skeptical; otherwise, you'd never make progress. However, as with any code you may find on the Internet, even from a trusted source, if it doesn't seem right and it goes against your instincts and experience, dig in deeper. Ask the AI why the code works, whether or not it accounts for use case X, or if it fits into the Principle of Least Privilege, or if it can use Y library instead.
AI is aware of the concepts of GitOps, the Principle of Least Privilege, and platform engineering, as well as many of the cloud infrastructure principles we put into practice at St. Thomas. However, unless you explicitly tell it to put those into practice, it will not apply them and will hand you tutorial-quality code.
When moving from developing a useful tool or script to creating a production application, developers and engineers must have a firm understanding of software and infrastructure engineering best practices, architecture, and guidelines used at St. Thomas, and a solid foundation in the framework and platform being developed upon. If you spot issues in AI-generated code, ask questions like "Does this follow the Principle of Least Privilege?" Or direct it: "Please rewrite this using the native XYZ library instead and remove the ABC dependency."
While vibe coding can be helpful for small projects, in enterprise production projects, the developer submitting the code should understand what every line does. This ensures security and maintainability. This is a standard best practice in any organization.
Based on his 2025 re:Invent "Renaissance Developer" framework, Werner Vogels, CTO of Amazon, posits that developers are responsible for the entire lifecycle of their software, emphasizing that while AI can generate code, human judgment must ensure its quality and purpose.
Understand Chat vs. Agent Mode and the Power that comes with it
Be aware of how much power you are giving the AI tool.
- Giving it too much power with no context, requirements, or guardrails, and unleashing it on your code can result in unrecoverable disasters.
- Accepting every prompt without proper review can lead to unintended issues.
- Allowing an Agent complete autonomous access to cloud resources can result in broken configurations, data loss, and unexpected charges.
Use version control and checkpoints so you can restore to a previous state. Refer to the article Git Essentials at St. Thomas for the power of version control.
Dive deeper
As we develop this page along with our strategies, we will explore concepts such as:
- AI-Assisted Engineering
- AI-Assisted Development
- Using AI for Peer Programming
The field is constantly evolving, so be sure to periodically search for the latest articles on the topics mentioned above in respected Developer, Software Engineer, and DevOps publications.
Here are a few in-depth articles and pages to get you introduced to AI AI-assisted engineering by Addy Osmani, an engineer at Google
AWS has released methodology, a free skill builder online course, and a repository to apply AI to the Development Lifecycle:
Kiro:
If you have any questions or would like to contribute to initiatives around AI-assisted coding, developer tools, or cloud tools, please reach out to the cloud team.
Agentic Engineering Workflow
- Setup: Get your specs and requirements together. Take time to sit down and think through what you want. Do you need guardrails and steering documents?
- AI-assisted Cycle:
- Planning: Let the AI take your specs and develop a formal plan (requirements, design, and tasks). Review and refine.
- Implementation: Have AI execute the tasks. Review what is generated and refine.
- Iteration: Continue to review and refine. Step back if you are in a loop and figure out how to reframe the requirement so AI can understand.
- Release
Charles and Josh of Power Squared released a 19-minute video titled "The ULTIMATE agentic engineering workflow (Claude Code, GitHub Copilot, Codex)" that can be applied to using Kiro as well. It doesn't delve into using these agentic products; instead, the video focuses on what a good workflow entails. Great high-level overview in a short and sweet video!