<h1>From Chatting to Engineering: How I Built Production-Grade AI Prompts (Levels 1–8)</h1>
<p>Most articles about “prompt engineering” stop at clever wording tricks.</p>
<p>This one doesn’t.</p>
<p>This is a practical walkthrough of how I went from <strong>asking questions in ChatGPT</strong> to building <strong>production-grade, security-reviewed AI specifications</strong> that my team could safely reuse.</p>
<p>If you’re a backend or full-stack developer and you’ve ever thought:</p>
<ul>
<li>“I like AI, but I don’t trust it for real systems”</li>
<li>“Prompt engineering feels too hand-wavy”</li>
<li>“How do I stop hallucinations in security-critical topics?”</li>
</ul>
<p>This article is for you.</p>
<hr>
<h2>The Core Problem with AI in Engineering</h2>
<p>AI is very good at:</p>
<ul>
<li>generating text</li>
<li>filling gaps</li>
<li>sounding confident</li>
</ul>
<p>AI is very bad at:</p>
<ul>
<li>knowing when it’s guessing</li>
<li>understanding consequences</li>
<li>respecting unstated constraints</li>
</ul>
<p>That makes it <strong>dangerous</strong> for:</p>
<ul>
<li>security</li>
<li>authentication</li>
<li>architecture</li>
<li>production decisions</li>
</ul>
<p>So instead of asking:</p>
<blockquote>
<p>“How do I write better prompts?”</p>
</blockquote>
<p>I started asking:</p>
<blockquote>
<p>“How do I make AI behave like a junior engineer who must justify everything?”</p>
</blockquote>
<p>That led me to a <strong>level-based system</strong>.</p>
<hr>
<h2>The Prompt Engineering Levels (Short Version)</h2>
<h3>Level 1–2: Chatting</h3>
<ul>
<li>Free questions</li>
<li>Learning concepts</li>
<li>Brainstorming</li>
</ul>
<p>✅ Fine for learning<br>
❌ Dangerous for production</p>
<hr>
<h3>Level 3–4: Structured Prompts</h3>
<p>You add structure:</p>
<ul>
<li>Role</li>
<li>Task</li>
<li>Context</li>
<li>Constraints</li>
<li>Output</li>
</ul>
<p>This already improves results a lot, but <strong>AI can still guess</strong>.</p>
<hr>
<h3>Level 5: Prompt Systems</h3>
<p>This is the turning point.</p>
<p>At Level 5, prompts become:</p>
<ul>
<li>reusable templates</li>
<li>versioned</li>
<li>stored in a repository</li>
<li>treated like code</li>
</ul>
<p>You stop writing one-off prompts and start building <strong>systems</strong>.</p>
<hr>
<h3>Level 6: Hardened Prompts (Reliability)</h3>
<p>This is where hallucinations die.</p>
<p>You force the AI to:</p>
<ul>
<li>declare assumptions</li>
<li>justify decisions</li>
<li>list failure modes</li>
<li>perform a self-check</li>
</ul>
<p>AI is no longer just a “builder” — it becomes <strong>builder + critic</strong>.</p>
<hr>
<h3>Level 7: Workflows (Agent Loops)</h3>
<p>Instead of one answer, you run a <strong>pipeline</strong>:</p>
<ol>
<li>Planner</li>
<li>Builder</li>
<li>Reviewer</li>
<li>Fixer</li>
<li>Packager</li>
</ol>
<p>No step can be skipped.</p>
<p>This mirrors how real engineering work happens.</p>
<hr>
<h3>Level 8: Team &amp; Company Scale</h3>
<p>At Level 8, AI usage becomes:</p>
<ul>
<li>standardized</li>
<li>reviewable</li>
<li>safe for teammates</li>
<li>boring (in a good way)</li>
</ul>
<p>You add:</p>
<ul>
<li><code>STANDARDS.md</code></li>
<li><code>TRAINING.md</code></li>
<li>security templates</li>
<li>approved workflows</li>
</ul>
<p>AI stops being “personal magic” and becomes <strong>organizational infrastructure</strong>.</p>
<hr>
<h2>A Real Case Study: 2FA TOTP Without Login Sessions</h2>
<p>To prove this wasn’t theory, I applied the full system to a <strong>security-critical feature</strong>:</p>
<blockquote>
<p><strong>Accessing a protected page using TOTP (Authenticator App) without creating a login session</strong></p>
</blockquote>
<p>Stack:</p>
<ul>
<li>Symfony 7 (API Platform)</li>
<li>React (Vite)</li>
<li>TOTP via <code>spomky-labs/otphp</code></li>
</ul>
<p>Constraints:</p>
<ul>
<li>No login</li>
<li>No session</li>
<li>No extra services</li>
<li>Short-lived access only</li>
</ul>
<p>This is exactly the kind of feature where AI usually fails.</p>
<hr>
<h2>The Hardened Prompt (Level 6+)</h2>
<p>The prompt explicitly defined:</p>
<ul>
<li>assumptions (traffic, frontend, storage)</li>
<li>constraints (no sessions, encryption, rate limits)</li>
<li>access model (short-lived, scoped token)</li>
<li>failure modes (brute force, replay, clock skew)</li>
<li>self-check (weak points, feasibility)</li>
</ul>
<p>Crucially, it <strong>forced clarity</strong> on things AI often guesses:</p>
<ul>
<li>how the QR code is delivered</li>
<li>how secrets are handled</li>
<li>how access is granted without login</li>
<li>what happens if replay protection is limited</li>
</ul>
<p>At this point, the prompt itself became a <strong>security specification</strong>.</p>
<hr>
<h2>The Workflow (Level 7)</h2>
<p>Then I wrapped the prompt in a workflow:</p>
<p><strong>2FA TOTP → Implementation Pipeline</strong></p>
<p>Steps:</p>
<ol>
<li>Planner restates requirements and risks</li>
<li>Builder designs architecture and code</li>
<li>Reviewer performs security checks</li>
<li>Fixer applies required changes</li>
<li>Packager delivers final artifacts + limitations</li>
</ol>
<p>The reviewer step explicitly checked:</p>
<ul>
<li>token TTL and scope</li>
<li>brute-force protection</li>
<li>replay risks</li>
<li>secret logging</li>
<li>accidental session creation</li>
</ul>
<p>The workflow failed once — and that was the point.</p>
<p>It forced a fix:</p>
<blockquote>
<p>Replay protection relied on TTL only, so the limitation had to be documented.</p>
</blockquote>
<p>That’s exactly how real security reviews work.</p>
<hr>
<h2>From Prompt to Company-Approved Standard (Level 8)</h2>
<p>The final step was extracting the result into a <strong>company-approved security template</strong>:</p>
<ul>
<li>When this pattern is allowed</li>
<li>When it is NOT allowed</li>
<li>Mandatory requirements</li>
<li>Known limitations</li>
<li>Review rules</li>
</ul>
<p>At that point, the AI output was no longer “an answer”.</p>
<p>It was:</p>
<ul>
<li>auditable</li>
<li>teachable</li>
<li>reusable</li>
<li>safe for others</li>
</ul>
<hr>
<h2>Reference Implementation &amp; Examples</h2>
<p>All prompts, workflows, and hardened security examples used in this article
are available as a public repository:</p>
<p>👉 <strong><a href="https://github.com/faez84/ai-prompts" target="_blank" rel="noopener nofollow">https://github.com/faez84/ai-prompts</a></strong></p>
<p>The repository includes:</p>
<ul>
<li>Level 5 reusable prompt templates</li>
<li>Level 6+ hardened security prompts</li>
<li>Level 7 implementation workflows</li>
<li>Level 8 standards (<code>STANDARDS.md</code>, <code>TRAINING.md</code>)</li>
</ul>
<p>You can fork it, adapt it, or use it as a starting point for your own team.</p>
<hr>
<h2>What Changed My View on AI</h2>
<p>The biggest realization was this:</p>
<blockquote>
<p>AI is not dangerous because it’s wrong.<br>
AI is dangerous because it hides uncertainty.</p>
</blockquote>
<p>Once I stopped trying to make AI <em>smarter</em> and started forcing it to:</p>
<ul>
<li>explain itself</li>
<li>doubt itself</li>
<li>expose weaknesses</li>
</ul>
<p>…it became reliable enough for real engineering.</p>
<hr>
<h2>Practical Takeaways for Developers</h2>
<p>If you want to apply this yourself:</p>
<ol>
<li>Don’t use free chat for production</li>
<li>Store prompts like code</li>
<li>Force assumptions and justifications</li>
<li>Use workflows for multi-step work</li>
<li>Never skip failure analysis</li>
<li>Standardize before scaling to a team</li>
</ol>
<p>You don’t need fancy tools.<br>
You don’t need agents.<br>
You need <strong>structure and discipline</strong>.</p>
<hr>
<h2>Final Thought</h2>
<p>Prompt engineering isn’t about clever wording.</p>
<p>It’s about <strong>engineering constraints into language</strong>.</p>
<p>Once you treat prompts like:</p>
<ul>
<li>design docs</li>
<li>security specs</li>
<li>review checklists</li>
</ul>
<p>AI stops being a toy and starts being a multiplier.</p>
<p>That’s when it becomes truly useful.</p>


Fayez

A practical framework for evolving AI prompt usage from casual chatting to production-grade engineering specifications. The author presents an 8-level progression system: from basic questions (Levels 1-2) through structured prompts (3-4), reusable templates (5), hardened prompts with self-checks (6), multi-step workflows (7), to company-wide standards (8). The approach emphasizes forcing AI to declare assumptions, justify decisions, and expose weaknesses rather than just generating answers. A real-world case study demonstrates implementing TOTP 2FA without login sessions using Symfony and React, with security-reviewed workflows that treat prompts as auditable specifications. All templates and examples are available in a public GitHub repository.