The Pattern
Step 1 — Persona A generates:
"As a [role A], [do the task]."
Step 2 — Persona B reviews:
"Now, as a [role B], review what
Persona A produced. Focus on [B's
area of expertise]."
Step 3 — Persona A fixes:
"Now, as [role A] again, incorporate
the feedback from [role B] and produce
the final version."
Example: Secure API Endpoint
Step 1: "As a backend developer, write
a Flask endpoint for user registration
that accepts name, email, and password."
Step 2: "As a security engineer, audit
this endpoint for vulnerabilities.
Check for: input validation, password
handling, SQL injection, rate limiting,
error information leakage."
Step 3: "As the backend developer, fix
every security issue found and produce
the final, secure version."
What the Security Persona Finds
Security audit findings:
1. CRITICAL: Password stored in plaintext
→ Use bcrypt with salt rounds ≥ 12
2. HIGH: No input validation on email
→ Validate format, check length
3. HIGH: No rate limiting
→ Add per-IP rate limit (5 reg/hour)
4. MEDIUM: Error returns full traceback
→ Return generic error to client,
log details server-side
5. LOW: No CORS configuration
→ Restrict to your frontend domain
Why Personas Work
Each persona activates a different “knowledge cluster” in the model. The developer persona optimizes for functionality. The security persona optimizes for safety. By chaining them, you get code that’s both functional and secure — something a single prompt rarely achieves.
Key insight: The Persona Chain is like having a team review. Developer writes, security reviews, developer fixes. You can extend this: add a “performance engineer” persona, a “UX designer” persona, or a “tech lead” persona. Each adds a perspective the others miss.