## Making AI reviews work for your team

While Graphite Agent will catch bugs out of the box, you can customize its behavior to better match your team’s specific needs and coding standards. AI reviews offer two primary customization options: **Exclusions** and **Custom rules**.

The Rules & exclusions tab shows custom rules and exclusions with their metrics

## Exclusions: Specifying what to ignore

Comment exclusions allow you to specify situations where Graphite Agent should **not** leave comments. This reduces noise and focuses AI reviews on what matters most to your team. Common exclusion use cases:

- **Ignore generated code**: Prevent extraneous comments on generated code from build artifacts, schemas, and other generated files.
- **Skip specific types of comments**: Turn off categories of feedback that aren’t relevant to your team
- **Ignore certain repositories or directories**: Focus AI reviews where they matter most
- **Exclude specific patterns**: Define patterns that shouldn’t be flagged (e.g., team-specific style conventions)

### Best practices for writing exclusions

Make the language as targeted as possible by specifying the exact scope where the exclusion should apply. If an exclusion is written too broadly, then Graphite Agent may not leave valid comments.

**Bad example:**

````
### Bad example: Overly broad exclusion

Don't suggest performance improvements.
````

**Good example:**

````
Do not suggest performance optimizations for code in the /scripts directory - these are one-time utility scripts.
````

## Custom rules: Teaching Graphite Agent your standards

Custom rules allow you to define explicit guidelines for Graphite Agent to follow when reviewing your code. This is especially powerful for enforcing team-specific best practices. With custom rules, you can:

- Define coding standards specific to your codebase
- Implement architectural guidelines for your team 
- Enforce security or performance best practices
- Ensure consistent patterns across your repositories

### Custom prompts (Recommended)

Custom prompts are rules written directly in the Graphite UI. They’re the recommended approach for most teams.

**Why custom prompts work best:**

- **Focused**: Each rule addresses one specific concern
- **Fast to iterate**: Test and refine rules based on their effectiveness
- **Better performance**: No file processing overhead
- **Easy to manage**: All rules across all repos visible in a single interface

**Getting started:**

1. Use built-in templates for common scenarios:   
   - Language-specific style guides (JavaScript, Python, Go, etc.)
   - Security best practices
   - Accessibility standards
2. **Start small**: Create focused rules that address specific concerns  
   - Example: “JavaScript error handling patterns”
   - Example: “API response formatting standards”
3. **Quick start**: Copy relevant sections from your existing coding guidelines and refine them into focused rules

### File-based rules

File-based rules reference existing documentation in your repository using glob patterns. Use these sparingly when you have living documentation that changes frequently.

**When to use file-based rules:**

- Documentation maintained by other teams that changes regularly
- Shared architectural decision records across repositories
- Style guides that are actively updated

### Best practices for writing custom rules

**Structure your rules clearly:**

- **Format**: Rule → Bad example → Good example → Reasoning
- **Focus**: One specific concern per rule
- **Examples**: Provide 2-3 clear, contrasting examples
- **Test**: Try your rule on recent PRs to verify it adds value

**What works best:**

- Language-specific conventions (naming, imports, error handling)
- Security guidelines (authentication, data validation)
- Framework-specific patterns (React hooks, API design)

**What to avoid:**

- Unnecessary context (“you are a staff-level engineer”)
- Overly broad rules (“write good code”)
- Praise
- Non-prescriptive verbs (“comment on” or “flag”)
- Comments that should actually be exclusions (“don’t comment on”)

**Bad examples:**

````
### Bad example 1: Vague database rule

Rule: Don't make breaking changes to database fields. When dropping or adding fields could cause issues, flag them in review.
````

**Good examples:**

````
### Good example 1: Security rule with clear structure

## Security Rules

### Rule: Never expose detailed error messages

**Rule:**
Never expose detailed error messages that reveal stack traces or internal system details. In production environments, always return generic error messages to protect the system while logging full details internally for debugging.

**Bad example:**
```js
app.use((err, req, res, next) => {
  res.status(500).json({ error: err.stack });
});
```

**Good example:**
```js
app.use((err, req, res, next) => {
  res.status(500).json({ error: "Internal Server Error" });
});
```

**Reasoning:**
Revealing stack traces or internal error details can leak sensitive implementation information, making it easier for attackers to exploit vulnerabilities.
````

``` 
**To set up custom rules:**

1. Go to the [AI reviews dashboard](https://app.graphite.com/ai-reviews)  
2. Navigate to the **Rules & exclusions** tab  
3. Click “Add” next to Custom rules  
4. Choose a template or add a custom prompt for your new rule  
5. Save your configuration

## Excluding files from AI review

For large repositories, you may want to exclude certain files from AI review analysis. This is useful for:

- Data files that don’t need to be reviewed
- Generated code that is automatically created by tools
- Any files that would make a PR too big for Graphite Agent to analyze

**Recommended file paths:**
Store your rules alongside your other code generation markdown files, or use one dedicated folder per repository. Common patterns include:

````  
docs/coding-standards.md    # Specific documentation file
CONTRIBUTING.md             # Contributing guidelines
docs/architecture/*.md      # Architecture documentation
.github/rules/*.md          # Rules folder in your repo
````

## PR-level filtering

Advanced PR-level filtering provides granular control over where AI reviews run. You can configure AI reviews to run on specific pull requests based on defined criteria.

## Measuring rule and exclusion effectiveness

The **Rules & exclusions** tab on the [AI reviews dashboard](https://app.graphite.com/ai-reviews) provides detailed analytics for each custom rule and exclusion you’ve created.

### Custom rules metrics

For each custom rule, you can track:
- **Issues found**: Total issues flagged by this rule
- **PRs reviewed**: Number of pull requests where this rule was applied
- **Accepted issues**: Issues that led to code changes
- **Acceptance rate**: Percentage of issues that were accepted
- **Upvote/Downvote rates**: Direct feedback from your team

### Comment exclusions metrics

For each exclusion, you can track:
- **Issues checked**: Total issues evaluated against this exclusion
- **PRs reviewed**: Number of pull requests where this exclusion was applied
- **Issues caught**: Issues that were filtered out by this exclusion
- **Percentage caught**: Proportion of checked issues that were excluded

### Using metrics to optimize

Use these metrics to:
- Identify high-performing rules to use as templates for new rules
- Refine or remove rules with low acceptance rates
- Understand which rules resonate with your team
- Fine-tune exclusions that are filtering too many or too few issues