Review policies

Review policies contain named additional instructions for a review. The module uses AI Prompt Management to manage them. AI Guardrails is a separate validation and safety facility; review policies do not replace or configure guardrails.

Manage policies and the default

Open the Review policies tab at /admin/config/services/ai_code_review_ui/review-policies. The list shows only the ai_code_review_ui_review_policy AI Prompt type.

The page and default selection require administer ai_code_review_ui. Adding, editing, and deleting policies use AI's forms and additionally require manage ai prompts.

The installation supplies Drupal Coding Standards, containing twenty coding instructions. Edit that policy or create named alternatives as needed. Choose one radio button in the Default column and click Save configuration. The None (no default) row omits additional instructions.

Select a policy for a review

The review form selects a policy by name. For AI tools, omitting review_policy_id uses the default; the literal value none omits additional instructions.

The policy is resolved during submission. Unavailable, disabled, blank, or invalid policies fail before the server request. The server receives only the literal Markdown instructions, without the policy's local ID or name. Template variables and tokens are never expanded.

The Server service account needs Submit AI Code Review Policies to accept additional instructions. None remains available without adding policy instructions to the request.

Saved instructions and limits

Each review stores read-only snapshots of the policy ID, name, format, and literal content. Later policy edits or deletion do not change those snapshots. The policy name appears on the review. Content is not returned by AI review tools or written to logs and has no default view formatter. Administrators can inspect the stored review_policy_content field through Drupal's entity API. Historical reviews are not backfilled.

Text must be valid UTF-8. Line endings are normalized to LF and one leading BOM is removed; repeated leading BOMs are rejected. Forbidden control and directional characters and consecutive variation selectors are rejected according to the server contract.

The configurable canonical text limit defaults to 32,768 bytes and cannot exceed the server ceiling of 49,152 bytes. The server may apply a lower limit or deny policies for the client. Policy validation never automatically retries or resubmits a review.