Encode team standardsinto every AI review
Configure team standards, path excludes, test-path rules, style strictness, security bar, and focus weights once. CodeCritic injects them into the prompt and surfaces violations as Policy findings - guidance for humans, not a merge gate by itself.
Six fields, one language
Team standards, excluded paths, paths that require tests, style strictness, security bar, and per-area review focus. Same shape for account defaults, repo overrides, and named profiles.
Policy findings, not nits
Violations of your written standards show as Policy findings in the app and in GitHub PR comments - separate from generic bug and security issues.
Profiles for paste and API
Pro and Enterprise: up to 10 named profiles (for example Rails API vs React SPA), default for new paste reviews, optional policy_profile_uuid on the API.
What applies when
Pick the right layer so paste, Action, and webhook runs stay predictable.
- Paste and API: account defaults, or a policy profile that replaces the baseline for that review (not a field-by-field merge).
- GitHub Action and webhook PRs: account defaults merged with an optional repository override for that owner/repo.
- Re-reviews in a chain inherit the parent review policy snapshot - expand Applied policy on the results page to verify.
Workflow
How teams wire it
- 1
Open Review Settings
Dashboard → Settings → Review Settings. Save account defaults with Save Settings.
- 2
Add repo overrides if needed
Connect GitHub, pick a repository, enable override, Save repository policies. Unset fields inherit from account defaults.
- 3
Create profiles on Pro / Enterprise
Name presets, optionally copy from account defaults, mark one as default for paste.
- 4
Read Policy findings
Filter policy-only in the app or open the Policy findings section on GitHub PR comments.
Overview
Not a linter substitute
Policies steer the LLM with your norms and path heuristics. They do not run ESLint, RuboCop, or fail CI by themselves. Pair them with deterministic checks when you need a hard gate.
Path-based rules are best-effort on pasted snippets without file paths - the model is told to skip path policy findings when paths are unknown.
Where this differs from rollout and security pages
The rollout landing is about how teams introduce AI review into merge culture. The security landing is about vulnerability classes in the diff. This page is about encoding your house rules so every channel - paste, API, Action - speaks the same dialect.
Checklist
- Profiles replace, overrides merge A selected profile replaces the account baseline for that paste/API review. Repo overrides only replace fields you set.
- API selection POST /v1/code_reviews accepts policy_profile_uuid, or use_account_policy: true to force account defaults.
- Free plan Account defaults only - named profiles are Pro and Enterprise.
FAQ
Common questions
Write the rules once
Start free with account defaults, then add repo overrides or Pro profiles when projects diverge.