The Modern AI-Assisted Workflow

The Modern AI-Assisted Workflow

AI coding agents have changed how software gets built. But the workflow hasn't become "let AI do everything." Instead, it's evolved into a structured pipeline where humans define and govern while agents execute and iterate.

This article walks through a realistic, production-grade workflow—from issue creation to merged pull request.

The Complete Pipeline

Stage 1: Issue Creation

Who: Human

What: Describe the problem clearly.

Issue: Login fails with 500 error when email contains + symbol

Expected: User can register/login with email+tag@example.com
Actual: Server returns 500 Internal Server Error
Steps to reproduce:
1. Go to /register
2. Enter email: test+tag@example.com
3. Click Register
4. See 500 error

Impact: Users with email aliases cannot register

Why this matters: A clear issue gives the agent (and human reviewers) a precise target. Vague issues produce vague implementations.

Stage 2: Requirements

Who: Human (with agent assistance)

What: Define acceptance criteria.

Acceptance Criteria:
  ✓ Email with + symbol registers successfully
  ✓ Email with + symbol logs in successfully
  ✓ Existing tests still pass
  ✓ New tests cover + in email
  ✓ No regression on standard email formats

Git command:

# No git command yet—this is planning

Stage 3: Planning

Who: Human + Agent

What: Break the task into steps.

Plan:
  1. Create feature branch
  2. Find email validation code
  3. Fix the regex to allow + in emails
  4. Add tests for + in email
  5. Run existing test suite
  6. Commit with descriptive message
  7. Create pull request

Git command:

# Create feature branch
git checkout -b fix/email-plus-symbol

Stage 4: Agent Implementation

Who: AI Agent

What: Implement the solution.

Agent actions:
  1. Reads auth.py (finds email validation regex)
  2. Identifies the bug: regex rejects + in local part
  3. Fixes regex: [a-zA-Z0-9._%+-] → properly escaped
  4. Reads existing tests
  5. Adds test case for email with + symbol
  6. Runs pytest — all tests pass

What the agent does NOT do:

• Does not commit (yet)
• Does not push
• Does not merge
• Does not make architectural decisions

Stage 5: Tests

Who: Agent runs, Human reviews

What: Verify the fix works and nothing broke.

# Agent runs tests
pytest tests/test_auth.py -v

# Output:
# test_register_standard_email PASSED
# test_register_email_with_plus PASSED  # NEW
# test_login_standard_email PASSED
# test_login_email_with_plus PASSED      # NEW
# 
# 4 passed in 0.12s

Stage 6: Security Review

Who: Human (with agent assistance)

What: Check for security issues.

Stage 7: Git Diff Review

Who: Human

What: Review exactly what changed.

# Review changes before committing
git diff

# Output:
# - email_regex = r'^[a-zA-Z0-9._%+-]+@...'
# + email_regex = r'^[a-zA-Z0-9._%+\-]+@...'
#
# Tests added:
# + def test_register_email_with_plus():
# +     assert register("test+tag@example.com") == 201

Questions to ask:

• Does the change match the requirements?
• Are there any unexpected modifications?
• Is the test meaningful (not just asserting True)?
• Would this change break anything else?

Stage 8: Commit

Who: Agent (with human approval)

What: Create a clean, descriptive commit.

# Stage changes
git add app/auth.py tests/test_auth.py

# Commit with descriptive message
git commit -m "fix: allow + symbol in email validation

- Update email regex to properly handle + in local part
- Add test cases for email addresses with + symbol
- All existing tests continue to pass

Fixes #42"

Why "Fixes #42"? It automatically closes the issue when the PR merges. Good automation.

Stage 9: Push and Create Pull Request

Who: Agent or Human

What: Push to remote and create PR.

# Push to remote
git push origin fix/email-plus-symbol

# Create pull request (via CLI or web UI)
gh pr create \
  --title "fix: allow + symbol in email validation" \
  --body "## Summary
- Fixed email regex to allow + in local part
- Added test cases for + in email addresses

## Testing
- All existing tests pass
- New tests verify + works in registration and login

## Related
- Fixes #42
- Related to #38 (email validation overhaul)"

Stage 10: Human Final Review

Who: Human (required)

What: Final approval before merge.

# After approval, merge
gh pr merge 42 --squash

# Or merge via web UI

The Complete Workflow Summary

Safety Rules for AI-Assisted Workflows

1. Never let agent push to main — Always use feature branches
2. Always review git diff — Understand every change
3. Run security checks — Before merge, not after
4. Use meaningful commits — Describe what and why
5. Keep PRs small — Easier to review, less risk
6. Require human approval — No auto-merge for code changes
7. Document decisions — Future you will thank present you

Try It Yourself

Practice this workflow with a small project:

1. Create a GitHub issue with a clear bug report
2. Write acceptance criteria
3. Use an AI agent to implement the fix
4. Review the git diff carefully
5. Run tests
6. Create a pull request with a good description
7. Review your own PR as if you were a teammate

Key Takeaways

• The workflow is human defines → agent implements → human reviews
• AI agents excel at implementation, testing, and commits
• Humans are responsible for requirements, security, and approval
• Always use feature branches and review git diffs
• Security review is non-negotiable on AI-generated code
• Keep PRs small and descriptions clear
• The agent follows your workflow—it doesn't replace it

Further Reading

• How AI Coding Agents Actually Work — BestWordz
• Agentic vs Traditional Programming — BestWordz
• AI Security Risks in 2026 — BestWordz
• Context Engineering Explained — BestWordz
• AI Pair Programming vs Agentic Programming — BestWordz

Related BestWordz Tools

• 🛠️ JSON Formatter — Format PR descriptions and API payloads
• 🛠️ Regex Tester — Test validation patterns
• 🛠️ Hash Generator — Generate commit signatures
• 🛠️ Base64 Encoder — Encode configuration data

💬 Discuss this topic on BestWordz Community — Share your AI-assisted workflow tips and best practices.