AI Architecture Review

You've built your architecture diagram. It looks fine. That is the trap: the failures that page you at 2am rarely show up in a diagram that looks fine.

The review feature in Codelit runs your diagram through an AI-powered analysis across four dimensions: security, scalability, cost efficiency, and compliance. It finds the problems you didn't think to look for.

The security review identifies:

• Single points of failure. "Your API gateway has no redundancy. If it goes down, everything behind it is unreachable."
• Missing authentication. "The connection between your frontend and API has no auth layer. Add an identity provider or API key validation."
• Exposed databases. "Your database is directly accessible from the public subnet. Move it behind a private subnet with security group rules."
• Missing encryption. "Data flows between services aren't marked as encrypted. Add TLS for service-to-service communication."
• No rate limiting. "Your public-facing API has no rate limiting. Add a rate limiter or WAF to prevent abuse."

The scalability review looks at:

• Bottleneck identification. "All traffic flows through a single service. This will bottleneck at approximately 10K requests/second. Add horizontal scaling or a load balancer."
• Missing caching. "Your read-heavy path hits the database on every request. Add a cache layer (Redis/Memcached) to handle repeated reads."
• Synchronous chains. "Services A, B, and C are called synchronously in sequence. If any one is slow, the entire chain is slow. Consider async messaging for B and C."
• Database scaling. "You have one database handling both reads and writes. At scale, add read replicas to offload query traffic."

The cost review catches:

• Over-provisioned resources. "You have a dedicated Elasticsearch cluster for a system that processes 100 documents/day. Consider a simpler search solution."
• Missing spot/preemptible options. "Your batch processing workers don't need to be on-demand instances. Spot instances would cut costs by 60 to 70 percent."
• Redundant services. "You have both a CDN and a caching layer doing the same job. Consolidate."
• Expensive patterns. "Polling your database every second for changes is expensive. Consider change data capture (CDC) or event-driven updates."

The compliance review flags:

• Data residency. "Your architecture spans multiple regions but doesn't specify where user data is stored. This may violate GDPR requirements."
• Audit logging. "No logging or audit trail service. Add centralized logging for regulatory compliance."
• Data encryption at rest. "Database nodes aren't marked as encrypted at rest. Required for SOC 2, HIPAA, and PCI DSS."
• Access control. "No IAM or role-based access control layer. Add RBAC for multi-tenant systems."

When you click "Review" (or press R), the entire diagram (nodes, edges, groups, and their metadata) is sent to the AI with a specialized review prompt. The AI analyzes the architecture as a whole, not just individual components.

This matters because most architecture problems are relational. A database isn't insecure by itself. It's insecure because it's connected to a public subnet without a security group. A service isn't a bottleneck by itself. It's a bottleneck because everything routes through it.

The review returns specific, actionable findings. Not "consider improving security" but "add a WAF between CloudFront and your API Gateway to filter malicious traffic." Each finding includes a severity (critical, warning, info) and a suggested fix.

I tested the review feature against 30 architectures designed by experienced engineers. It found legitimate issues in 28 of them. The most common ones:

1. Missing health checks (found in 22/30): services connected to a load balancer but no health check endpoint defined
2. No circuit breaker pattern (found in 18/30): synchronous service-to-service calls with no failure handling
3. Single database for everything (found in 15/30): one database handling authentication, business logic, and analytics
4. No async processing (found in 14/30): long-running tasks executed synchronously in the request path
5. Missing monitoring (found in 12/30): no observability layer (logging, metrics, tracing)

These aren't exotic problems. They're the fundamentals that get overlooked because you're focused on the business logic, not the infrastructure.

The review is a starting point for discussion, not a production audit. It doesn't know your traffic patterns, SLA requirements, or budget constraints. It can tell you "this will bottleneck at scale" but it can't tell you whether your scale justifies the fix.

Use it as a checklist before your architecture review meeting, not as a replacement for one.

Build or import a diagram on codelit.io, then press R or click the review button. See what it finds. It tends to catch the thing you stopped noticing.

See the full set of checks on the features page.