Design Pattern & Best Practice Review Agent

Manual code review is the most common quality gate in Salesforce development — but it does not scale, and it is never fully consistent. As teams and codebases grow, the gap between what gets reviewed and what gets deployed widens:

• SOQL queries inside loops and governor limit risks go unnoticed until they cause failures under load
• Missing security checks — CRUD permissions and field-level access — create compliance and data exposure risks
• Hardcoded record IDs, endpoints, and API keys buried in code create maintenance and security problems
• Poor exception handling means errors fail silently rather than being surfaced and logged
• Trigger logic without handler patterns and missing recursion guards creates fragile, hard-to-maintain code
• Peer review coverage depends on who is available — the same standards are not applied consistently across all code

The agent runs automatically on a recurring schedule, scanning only the Apex classes and triggers that have been created or modified since the last completed review cycle. Each changed artifact is submitted to an AI model with a structured set of Salesforce-specific quality criteria, and the findings are stored as a reviewable record in Salesforce.

The process runs in four steps, entirely without manual initiation:

Step 1 — Changed Artifacts Identified

At the start of each run, the agent identifies every Apex class and trigger modified since the last successful review cycle. Only changed code is reviewed — unchanged artifacts are skipped, keeping the process efficient regardless of overall codebase size.

Step 2 — AI Reviews Each Artifact

Each artifact is submitted to an AI model with a detailed set of Salesforce-specific review criteria. The AI reads the full source code — including large classes, which are processed in sections to ensure nothing is skipped — and evaluates it across seven quality dimensions.

Step 3 — Findings Structured and Stored

The AI returns a structured quality report for each artifact: a list of issues found, a concrete fix recommendation for each issue, a total issue count, and an overall severity rating. Each report is saved as a Salesforce record linked to the source artifact.

Step 4 — Watermark Advanced for Next Run

Once a run completes without errors, the review cycle timestamp is updated automatically. The next scheduled run picks up only artifacts modified after this point — ensuring every change is reviewed exactly once, and any artifact affected by an error is automatically retried on the next cycle.

The Design Pattern and Best Practice Review Agent is an Agentic solution built natively on the Salesforce platform. The orchestration layer runs autonomously end-to-end — continuously scanning for changed Apex artifacts, submitting each to an AI model for structured quality analysis, storing findings as Salesforce records, and advancing the review watermark — without any manual initiation or intervention. Each capability is delivered through Salesforce technologies as follows:

• Incremental Artifact Detection: Changed Apex classes and triggers are identified on each scheduled run by comparing artifact last-modified timestamps against a stored review cycle watermark, handled entirely through Apex automation. Only org-owned artifacts are returned; managed package code is excluded automatically.
• AI-Powered Quality Analysis: Each artifact’s full source code is submitted to an AI model via Salesforce Named Credentials, evaluated against seven Salesforce-specific quality dimensions: governor limit risks, security vulnerabilities, hardcoded values, exception handling, anti-patterns, trigger criteria, and null safety. Large classes are automatically split at code boundaries and processed in sections to ensure complete coverage with no truncation.
• Structured Findings Storage: The AI returns a structured quality report for each artifact — containing identified issues with type, description, and per-issue severity; a concrete fix recommendation for every issue; a total issue count; and an overall severity rating (Critical, High, Medium, or Low). Each report is written to a Salesforce record linked to the source artifact, available immediately in list views, dashboards, and reports.
• Review Cycle Watermark Management: The review cycle timestamp advances automatically only after a fully error-free run completes. Any artifact affected by a processing error is automatically retried on the next scheduled cycle — ensuring no change is ever silently skipped. Watermark state is managed through Apex custom settings, requiring no external tooling or pipeline dependency.
• Severity Classification & Issue Prioritisation: The AI model assigns an individual severity rating to each identified issue and derives an overall artifact-level severity rating. A deterministic Apex post-processing step captures total issue counts and severity distribution per artifact, making findings comparable, sortable, and reportable across the entire codebase without manual triage.
• Actionable Fix Recommendations: For every issue identified, a prompt template instructs the AI to generate a concrete, plain-language fix recommendation — not a generic observation. Developers receive specific guidance on what to change and why, reducing the time between finding and resolution without requiring further manual interpretation.

Architecture Principle: Deterministic Apex handles all scheduling, artifact detection, watermark management, and record persistence — guaranteeing auditability and reliability for code that runs in production. Generative AI prompt templates handle quality evaluation and natural-language fix recommendations. The combination makes the system truly agentic: it runs end-to-end on its own, reviews every change exactly once, and surfaces actionable findings without waiting to be asked.

Incremental Scanning — Only Changed Code Is Reviewed

The agent does not re-review the entire codebase on every run. It tracks a review cycle timestamp and only picks up artifacts modified since the last completed run. This keeps each execution fast and focused, regardless of how large the overall codebase grows.

• Only newly created or modified Apex classes and triggers are reviewed each cycle
• Managed package code is automatically excluded — only org-owned artifacts are reviewed
• Artifacts affected by errors on one run are automatically retried on the next
• Review cycle advances only after a fully successful run — no changes are silently skipped

Seven-Dimension Quality Review — Covering the Issues That Matter Most

Every artifact is evaluated against a comprehensive set of Salesforce-specific quality criteria that covers the categories most likely to cause production incidents, security vulnerabilities, or long-term maintainability problems.

• Governor limit risks — SOQL queries inside loops, DML in loops, and bulkification gaps
• Security vulnerabilities — missing CRUD permissions and field-level security checks
• Hardcoded values — record IDs, endpoints, URLs, and API keys embedded in code
• Exception and error handling — missing try-catch blocks, silent failure patterns
• Anti-patterns and separation of concerns — logic placement, naming standards, code structure
• Trigger-specific criteria — handler pattern usage, recursion guards, missing context checks
• Null safety — missing null checks that could cause unexpected runtime failures

Structured Quality Reports — Issues, Fixes, and Severity in One Record

Each review produces a structured quality report stored as a Salesforce record linked to the source artifact. Reports are consistent in format across every class and trigger reviewed, making findings comparable, reportable, and actionable without any manual formatting or interpretation.

• Issues found listed with type, description, and individual severity per issue
• Concrete fix recommendation provided for every issue identified
• Total issue count recorded per artifact for trend tracking and dashboards
• Overall severity rating: Critical, High, Medium, or Low
• Source artifact name, type, last-modified date, and last-modified-by captured on every report
• AI model identifier recorded for traceability as models are updated over time

Full Coverage for Any Class Size — No Artifacts Skipped

Large Apex classes are reviewed in full, not truncated. The agent automatically splits oversized source files into sections and processes them sequentially, maintaining full context across sections so the AI can assess the complete artifact rather than an incomplete fragment.

• Apex classes of any size are reviewed completely — no truncation or skipping
• Large files split intelligently at code boundaries to preserve context across sections
• Small and large artifacts handled transparently — no configuration required per class
• Review quality is consistent regardless of artifact size

For Developers

• Receive structured, actionable feedback on every class and trigger you modify — not just the ones that get peer reviewed
• Concrete fix recommendations with each issue mean less time diagnosing and more time resolving
• Consistent quality criteria applied to every artifact — no dependency on reviewer availability or focus
• Issues caught in the review cycle, not in production

For Technical Leads & Architects

• Full visibility into the quality and risk profile of the codebase as it evolves — not just at release time
• Severity ratings and issue counts across all artifacts support prioritisation without manual triage
• Trigger-specific criteria ensure handler patterns, recursion guards, and bulkification are consistently enforced
• Historical report records show how code quality trends over time across the team

For Operations & Business Leaders

• Reduce the risk of governor limit failures, security gaps, and silent errors reaching production
• Lower the cost of fixing code quality issues — findings surfaced early, before they compound
• Continuous automated review scales with team and codebase growth — no additional reviewer headcount needed
• Auditable record of every quality review, finding, and recommendation stored in Salesforce