Question

A software company wants to build a generative AI assistant that reviews pull requests. For each PR, the assistant must: (1) summarize the code changes, (2) flag potential security vulnerabilities against the company's internal secure-coding guidelines, and (3) generate a natural-language review comment that references specific findings. The security guidelines are a large, frequently updated internal document. As the GenAI engineer designing this application, what is the most appropriate high-level architecture?

Accepted Answer

A chain that first summarizes the diff, then performs a RAG step retrieving relevant guideline sections from a vector index to identify vulnerabilities, then composes the review comment from the prior outputs

Answer

A single prompt that pastes the full secure-coding guidelines and the entire code diff into one LLM call, asking it to return the summary, vulnerabilities, and review comment together

Answer

Fine-tune a base model on the secure-coding guidelines and use it directly to produce all three outputs from the raw diff in one step

Answer

Three fully independent LLM calls that each receive only the raw diff, with no shared context or retrieval, and concatenate their outputs