Technical guardrails for LLM-assisted code: the full catalog

Our report More code, less confidence maps where quality breaks in AI-assisted teams: pull requests 2.5x larger, duplicated blocks up 81% in three years, error-masking constructs up 47%, review time up 441%. It ends on the habits of the teams that escape it — small batches, gates in CI, a Definition of Done that doesn’t bend.

This is the other half: the concrete catalog behind those habits. Each layer catches what the previous one missed. The failure modes they target are the ones in the 2025–26 data — oversized PRs, duplication, error-masking, “almost right” code, hallucinated dependencies, and review overload.

Ordering principle: the cheapest gate is the one closest to the moment code is written. Agent hooks, then pre-commit, then CI, then review, then production — in rising order of cost. Push every check as far left as it can run.

Layer 0 — Agent and editor context (before code exists)

Prevention starts before the LLM writes a line. Most “bad AI code” is the model guessing conventions it was never given.

Layer 1 — Compiler and type system

The cheapest reviewer you have. Make it maximally strict; LLM code that “almost works” often dies right here.

Layer 2 — Linting, complexity and hygiene

This is where you encode “bring sense to the code” as executable rules instead of review comments.

Core: typescript-eslint with strict-type-checked + stylistic-type-checked presets (or Biome if you trade rule depth for speed). --max-warnings 0 — a warning is a future ignored error.

Layer 3 — Architecture enforcement (NestJS scope rules)

Linting checks lines; this layer checks the shape. It’s the answer to “rules for ensuring scope of NestJS architecture” — make the layer diagram executable.

dependency-cruiser — the workhorse. Declare what may import what; CI fails on violation:

// .dependency-cruiser.cjs — examples
module.exports = {
  forbidden: [
    { name: 'no-circular', severity: 'error', from: {}, to: { circular: true } },
    { name: 'domain-is-pure',            // domain imports nothing from infra/http
      from: { path: '^src/.*/domain' },
      to:   { path: '^src/.*/(infrastructure|controllers|typeorm|prisma)' } },
    { name: 'controllers-use-services',  // controllers never touch repositories
      from: { path: '\\.controller\\.ts$' },
      to:   { path: '(\\.repository\\.ts$|/entities/)' } },
    { name: 'no-cross-module-internals', // other modules only via its public index
      from: { path: '^src/modules/([^/]+)/' },
      to:   { path: '^src/modules/(?!$1)[^/]+/(?!index\\.ts)' } },
  ],
};

Layer 4 — Data and API contracts

The “almost right” code that hurts most fails at boundaries. Pin every boundary with a schema.

Layer 5 — Local git hooks (pre-commit / pre-push)

Fast feedback before anything leaves the machine. Keep pre-commit under ~5 s or people (and agents) will bypass it.

Layer 6 — Agent-native guardrails (when the LLM finishes, before commit)

The newest layer: deterministic hooks around the agent itself, so verification happens before a human ever sees the diff.

Example (Claude Code, .claude/settings.json):

{
  "hooks": {
    "PostToolUse": [{
      "matcher": "Edit|Write",
      "hooks": [{ "type": "command",
        "command": "npx eslint --fix $CLAUDE_FILE_PATHS && npx tsc --noEmit" }]
    }],
    "Stop": [{
      "hooks": [{ "type": "command",
        "command": "pnpm lint && pnpm typecheck && pnpm test:affected" }]
    }]
  }
}

Layer 7 — CI/CD pipeline gates (the PR wall)

Everything above runs advisory-fast; CI is where it becomes law. All gates as required status checks — non-required checks are decoration.

Correctness and tests

Security and supply chain

LLMs made this layer non-optional.

Repo policy

Layer 8 — Post-merge and runtime (assume something got through)

If you only adopt ten things

The elite-team cut:

1. TypeScript maximal strict + tsc --noEmit as a required check.
2. typescript-eslint strict-type-checked with complexity budgets and error-masking bans, --max-warnings 0.
3. Prettier/Biome + husky + lint-staged + commitlint.
4. dependency-cruiser rules for your NestJS layers + no-cycle, as a required check.
5. Global ValidationPipe (whitelist + forbid) and Zod-validated config.
6. Agent hooks: post-edit lint/typecheck + a stop-gate running affected tests; deny-list for secrets, migrations, CI config.
7. Diff coverage of 80% or more + Sonar quality gate on new code; Stryker on the money paths.
8. PR size gate (~400 lines) + Danger metadata contract + CODEOWNERS + merge queue.
9. Socket/dependency-review + frozen lockfile + Renovate with minimumReleaseAge.
10. Feature flags + canary + OTel/Sentry tied to releases, with DORA + churn dashboards to verify it’s working.

Two honest caveats. Gates only work if they’re fast (parallelize CI, cache, affected-only runs) — slow gates get bypassed, and bypassed gates are worse than none. And no pipeline reviews intent: these guardrails buy your humans the time to do the one review only humans can do — “is this the right change?”

That is the same conclusion the data reaches in More code, less confidence: AI is an amplifier. This catalog is what “a strong engineering system” looks like when you write it down as configuration.

Further reading

• Agent hooks: deterministic guardrails for AI-generated code
• Repository guardrails for AI-generated code
• Git hooks are your best defense against AI-generated mess
• GenAI-based development platform, part 1: guardrails (microservices.io)
• When AI writes the code, build guardrails instead of reviewing every line
• CSA research note — Slopsquatting: AI hallucinations fuel supply-chain attacks
• Socket — 53 slopsquatting targets across 5 frontier LLMs
• Sonar — quality gates at the PR level
• LinearB — 8M PRs: where productivity breaks down
• Lab34 — More code, less confidence: where quality breaks in agile teams