AI Writes Your Code, But Who Sets the Rules?

There's a phrase that's been circulating in developer circles lately, usually delivered with the weary confidence of someone who has lost an argument with their own tools: "prompts are suggestions." A recent video from the Laravel channel puts that phrase to work in a concrete, replicable way—and the demonstration is worth sitting with, even if you've never touched a line of PHP.

The setup is deliberately simple. A developer builds the same recipe web application twice using Claude Code. First run: a single natural-language prompt describing what the app should do. Second run: the same prompt, but this time anchored to a structured set of guidelines and tooling that tell the AI what "good code" means in this particular project. The results aren't identical—they're not supposed to be—but the gap between them maps cleanly onto a problem that anyone using AI code generation at scale is going to have to solve eventually.

The honest problem with one-shotting

The first build works. That's worth acknowledging plainly. Twenty minutes after the prompt goes in, there's a running Laravel application with a public recipe browser, category filters, a detail page, and an admin area with authentication. For an MVP, it's fine. For a demo, it's impressive.

The code underneath is another story. No return types on controllers. PHPUnit tests instead of Pest (the Laravel-native testing framework that's faster and more expressive). A hand-rolled authentication controller that reinvents features Laravel's own starter kits already ship with—two-factor authentication, password reset, security settings. The composer.json test script does exactly one thing: run the tests. No formatting checks, no static analysis, nothing to catch type errors before they hit production.

"I tried this example prompt now already a couple of times," the presenter notes, "and I can tell you with the prompt that we have, every time the result is different. Not just from the design—because this is what we expect—but also from the code quality itself."

That variability is the real issue. Sometimes the AI uses enums for categories, sometimes it uses a database table. Sometimes it reaches for a starter kit, sometimes it builds from scratch. The functional output is roughly equivalent across runs. The structural decisions—the ones that determine how maintainable this codebase is in six months—are effectively random.

This isn't a knock on Claude specifically. It's a property of how large language models work: they're probabilistic, not deterministic, and without constraints they'll make different stylistic choices each time, much like a contractor who builds whatever they think looks good rather than what the building code requires. The security and consistency risks this introduces compound over time, especially when multiple AI agents are working on the same codebase and reinforcing each other's arbitrary choices.

What guardrails actually look like in practice

The second build starts with one additional line in the prompt: fetch and follow instructions from Laravel's AI-specific documentation file, and treat it as the source of truth. That file—maintained by the Laravel team and linked in their official docs—tells the AI how to install the framework correctly, which starter kit to use, how to verify the local environment, and what conventions to follow.

The difference in output is immediate and visible. The second app uses a React starter kit, which brings along reusable components, instant client-side filtering, and a settings panel with two-factor auth already wired in. The controller code has return types throughout. Categories use PHP enums. The composer.json now runs three things in sequence: Laravel Pint for code formatting, PHPStan with Larastan for static analysis, and the test suite. GitHub Actions workflows come bundled with the starter kit, meaning every push to the repository triggers the same checks locally.

The presenter adds Rector on top of that stack—a tool that goes further than static analysis by actually rewriting code to match specified standards. When Rector runs, it finds that a model's $fillable array could be replaced with a modern PHP attribute syntax, and changes it automatically. "Now, every time something new—a new attribute comes out—Rector knows about it, and we can make sure we're using them everywhere so that we have consistent code through all the application."

The point isn't that the second app is aesthetically superior. It's that the second app's quality isn't contingent on the AI having a good day.

The scaffolding question

What's interesting about this approach—and also what's worth probing—is that most of the guardrails here aren't AI-specific. Laravel Pint, PHPStan, Pest, CI pipelines: these are tools that disciplined development teams have been using for years, with or without AI in the loop. The video is essentially arguing that the arrival of AI code generation doesn't change what good engineering practice looks like; it makes that practice more urgent.

That's a reasonable position. But it also surfaces a tension that the video doesn't fully address: the guardrails work here partly because Laravel has done significant upstream work to make AI-compatible documentation available. The team maintains a dedicated markdown file for AI agents, builds starter kits that already include the right tooling, and ships a package called Laravel Boost that pre-loads context files so coding agents know the project's conventions before they write a single line.

Not every framework does this. Not every organization has the resources to maintain AI-specific documentation and keep it current. The question of who builds these guardrails—and who has access to teams capable of maintaining them—is worth keeping in mind as the demo makes it all look admirably smooth.

There's also the question of what happens when the guardrails themselves are wrong. Rector rewrites code according to rules; if those rules are misconfigured, it rewrites code incorrectly, with the same confidence and speed it brings to doing it right. Static analysis catches type errors it knows about. It doesn't catch logical errors in business requirements. The CI pipeline enforces the standards you've defined—which means the standards still need to be defined correctly by a human who understands the domain. None of these tools eliminate judgment; they encode it.

The accountability layer

"AI is incredible at writing code, we all notice," the presenter says near the end, "but we decide what good code means to us."

That framing—we decide—carries more weight than it might seem. The guardrails in this demo are technical artifacts, but they're also organizational ones. They represent decisions made by someone who understood the codebase well enough to write down what "good" looks like. A team that lacks that knowledge, or the time to codify it, can't just install Rector and expect the same results.

This is the part of the AI coding conversation that tends to get glossed over in the enthusiasm about speed and productivity. The tools that make AI more consistent and reliable require human expertise to configure correctly. That expertise doesn't disappear as AI gets better—it migrates. Instead of writing every line of code, developers are increasingly in the business of defining the constraints within which AI writes code.

Whether that's a reduction in what developers do or a transformation of it is a genuinely open question. The demo makes the transformation look clean: one structured prompt, a handful of well-chosen tools, a CI pipeline that catches anything that slips through. In practice, the line between "guardrails that improve AI output" and "guardrails that paper over a gap in team knowledge" can be harder to see clearly than a twenty-minute video can convey.

The recipe app runs. The tests pass. The code is consistent. That's real. The harder question is what happens when the recipe is wrong.

---

Marcus Chen-Ramirez is a senior technology correspondent for Buzzrag covering AI, software development, and the intersection of technology and society.