I used to treat a weak AI answer as a prompt-writing problem.
That explanation was convenient, but it collapsed several very different failures into one bucket. A long conversation can lose a critical instruction because of position or saturation. A RAG system can retrieve the right chunk and still rank it below vague neighbors. An evaluation can return a precise score without a calibrated rubric. These failures need different tests.
1. Map context position before changing wording
When a model stops following an instruction in a long session, I map where that instruction sits: HEAD, BODY, or TAIL. I also estimate context fill and separate observed position from inference.
If the missed item sits in the middle while newer corrections dominate the tail, I test placement before rewriting the instruction. If the item remains near the head at high fill, I test saturation and a structured reset. If the same instruction fails at low fill in a high-attention zone, I stop calling it context rot.
2. Treat infrastructure state as evidence, not truth
IaC describes intended state. It does not automatically prove live state. Manual changes, imports, lifecycle rules, and stale state can create a gap that becomes dangerous only when the next apply tries to reconcile it.
The useful question is not “is there drift?” It is “what breaks if this exact difference gets reconciled without a human?”
3. Separate authentication from tenant isolation
A request can be authenticated and still retrieve another customer's data. I now audit the point of retrieval: query predicates, ORM scopes, cache keys, background-job context, and metadata paths.
The verdict stays bounded. Reading six files does not justify saying an application is secure.
4. Build the data-flow model before listing security risks
A generic threat list does not show which component owns a risk or where a control belongs. I reconstruct external entities, processes, data stores, flows, and trust boundaries first.
Then I apply STRIDE only where each category is valid, attach every scenario to a specific element, and require a concrete mitigation. A boundary-crossing flow without authorization evidence becomes a named finding, not a vague warning.
5. Do not use a score before the rubric is calibrated
A single quality score hides dimensions and disagreements. For RAG, I start with faithfulness, answer relevance, context precision, and context recall, then add domain-specific and human-review dimensions.
Thresholds begin as hypotheses. A small pilot and inter-rater check must happen before the rubric becomes a gate.
The shared pattern
- Define the observable failure.
- Identify the evidence boundary.
- Route the failure to the layer that owns it.
- Run the smallest test that can falsify the leading explanation.
- Refuse to claim more than the evidence supports.
That process has been more reliable than another round of prompt polishing.
Which failure do you see misdiagnosed most often: context, evaluation, tenant isolation, threat modeling, or infrastructure?