The Plan-Act-Review Loop in Practice

Module 07: AI Development Workflows | Expansion Guide

Back to Module 07

The Problem

You're building with AI. It generates code. You run it. Something breaks. You ask for a fix. It changes three things when only one needed fixing. You're now debugging AI changes instead of building features.

The issue: You're treating AI collaboration like a magic wand instead of a structured process.

Without a workflow, AI development becomes chaos. You ping-pong between "can you add this" and "that broke everything." You accept code without understanding it. You fix the same bugs repeatedly because you never established what success looks like.

The Core Insight

AI is a tool, not a teammate. You need the discipline.

Human teams use structured workflows - planning sessions, code reviews, retrospectives. AI teams need the same, but you have to be both product manager and QA engineer. The Plan-Act-Review loop gives you that structure.

Think of it like the scientific method: hypothesis (plan), experiment (act), analyze (review), repeat. Each cycle tightens the feedback loop and builds better code.

The Walkthrough

Phase 1: Plan

Goal: Define success criteria before writing code.

Questions to answer:

Example Plan Message:

"I need to add user authentication to this Express app.

Success criteria:
- Users can register with email/password
- Passwords are hashed with bcrypt
- JWT tokens stored in HTTP-only cookies
- Login/logout endpoints work

Constraints:
- Use existing User model in @models/User.js
- Follow error handling pattern from @middleware/errorHandler.js
- Must work with current @config/database.js setup

Verification:
- Manual test with curl commands
- User can register, login, and access protected route"

Notice: Specific, testable, constrained. AI has guardrails.

Phase 2: Act

Goal: Let AI generate code with minimal interruption.

Rules for this phase:

  1. Don't interrupt mid-generation: Let AI finish the task
  2. Accept code without immediate edits: You'll review in next phase
  3. Note questions: Write down what confuses you for review
  4. Save the state: Commit or checkpoint before testing

Why this matters: Context switching kills productivity. If you interrupt AI to fix small issues, you break its coherent train of thought. Let it complete, review holistically.

The One Exception Rule

Only interrupt if AI is obviously on the wrong path (e.g., "Wait, I said PostgreSQL not MongoDB"). Otherwise, let it finish.

Phase 3: Review

Goal: Verify against plan, identify gaps, decide next action.

Review checklist:

Check Question Action if Failed
Acceptance Does it meet success criteria? Next iteration on missing criteria
Constraints Did AI follow patterns? Point out violations explicitly
Verification Does it actually work? Test first, then diagnose
Completeness Any obvious gaps? Add to next plan
Quality Is it maintainable? Request refactor if not

Review Message Template:

"Review results:

✅ Works: Registration and login endpoints functional
✅ Patterns: Follows error handling correctly
❌ Missing: Password validation (min 8 chars)
❌ Bug: JWT expiry not set correctly
⚠️  Concern: No rate limiting on login endpoint

Next iteration plan:
1. Fix JWT expiry to 24 hours
2. Add password validation
3. Consider rate limiting (optional, low priority)"

Phase 4: Repeat

Each cycle narrows the gap between current state and done. Loop until all acceptance criteria pass.

Real-World Example: Building a Feature

Task: Add file upload to a blog post editor.

Iteration 1

Plan:

"Add file upload for blog posts.
- Accept images (jpg, png) up to 5MB
- Store in AWS S3
- Return URL to embed in post
- Handle errors gracefully

Constraints:
- Use existing S3 config from @config/aws.js
- Follow multer pattern from @routes/profile.js

Test: Upload image, get URL, embed in blog post"

Act: AI generates upload route, S3 integration, error handling.

Review:

✅ S3 upload works
✅ File size validation correct
❌ No file type validation (accepts any file)
❌ Missing Content-Type header on S3 object
⚠️  Security: No authentication check on upload endpoint

Iteration 2

Plan:

"Fix from review:
1. Add file type validation (jpg, png only)
2. Set Content-Type on S3 upload
3. Add auth middleware from @middleware/auth.js to upload route"

Act: AI fixes three issues.

Review:

✅ All acceptance criteria met
✅ Security checks in place
✅ Tests pass
⚠️  Note: Consider adding image compression (future enhancement)

Result: Feature complete in 2 iterations, ~30 minutes total.

Failure Patterns

1. Planning Paralysis

Symptom: You spend 30 minutes writing the perfect plan.

Fix: Plans should take 2-5 minutes. Start simple, refine in iterations.

2. Skipping Review

Symptom: AI generates code, you immediately accept and move to next feature.

Fix: Always review. Even if it "looks right," test against criteria.

3. Vague Plans

Symptom: "Add authentication" with no details. AI invents everything.

Fix: Specific constraints and success criteria. "Use JWT, store in cookies, follow existing pattern in X file."

4. Mega-Iterations

Symptom: Plan has 10 items. Review finds 8 issues. Overwhelmed.

Fix: Smaller iterations. 2-3 acceptance criteria per cycle maximum.

The Trust-But-Verify Trap

AI-generated code often looks clean. This creates false confidence. Always run the code. Always check edge cases. "Looks good" is not the same as "works correctly."

Advanced Loop Patterns

Pattern 1: Nested Loops

For complex features, use loops within loops:

Complete each inner loop before moving to next component.

Pattern 2: Parallel Loops

For independent features, run separate loops:

Different AI sessions, no context interference.

Pattern 3: Async Review

For long-running tasks (migrations, large refactors):

  1. Plan and Act in one session
  2. AI generates code
  3. You review later (next day, after coffee)
  4. Continue loop in fresh session with review notes

Quick Reference

Plan Phase (2-5 minutes):

Act Phase (5-20 minutes):

Review Phase (5-10 minutes):

Iteration Sizing:

Red Flags: