DEV Community: Braa Al-salahi

When Both Manager & Employee Use AI, Why Are Results Misaligned?

Braa Al-salahi — Thu, 22 Oct 2026 01:25:59 +0000

When Both Manager & Employee Use AI, Why Are Results Misaligned?

**
How to ensure team outputs match expectations from the very first draft, without exhausting your employees with constant explanations**

From Task Delegation to Skill Orchestration: Solving the "Context Degradation" Crisis in AI-Augmented Workflows

In modern engineering and tech workspaces, we are caught in a time-draining paradox: AI has become the primary execution engine for managers, engineers, and clients alike. Yet, daily workflows have devolved into lossy feedback loops where requirements, constraints, and quality degrade with every exchanged message.

The real bottleneck is no longer AI capability. The problem is Context Degradation caused by humans acting as inefficient, lossy relays between two intelligent models.

1. Deconstructing the Crisis: The Context Loss Loop and "Prompt Shaming"

In practice, executing a task across software and cross-functional teams follows a fundamentally broken sequence:

Lossy Summarization: A manager or client drafts a detailed prompt using AI, extracts a brief summary to "save time," and forwards it to the developer.
Ambiguous Execution: The developer receives this incomplete summary, feeds it into their own local or cloud AI along with raw inputs, and asks the model to fill in the gaps and guess the missing parameters.
The AI Stigma (Prompt Shaming): Fearing that their work might look like "cheap, lazy AI output," both sides scrub out essential structural guidelines, boilerplate, and strict technical constraints before sending it across. Critical specifications are silently discarded in the name of looking human.
The Review Feedback Loop: The manager runs the submission through AI to evaluate it against original expectations that were never communicated to the developer in the first place. A frustrating cycle of revisions and ping-pong messaging begins.

Both sides use AI, but each prompts from scratch using completely different mental models, wasting engineering hours trying to align expectations rather than shipping features.

2. The Architectural Fix: The Shared Skill Protocol

Instead of passing vague task descriptions back and forth, team communication shifts to sharing versioned Custom Skill Modules.

A "Skill" here is not an expensive model retraining pipeline; it is a structured operational contract (a version-controlled Markdown or YAML file) that encodes the organization’s baseline standards:

Strict Task Objectives.
Non-Negotiable Constraints & Edge Cases.
Deterministic Output Schemas (JSON schemas, architectural patterns, report structures).
Pre-Flight Validation Checklists.

Concrete Skill Blueprint:

# Skill: Executive Meeting & Project Brief
- Objective: Transform raw notes and operational telemetry into a 1-page executive brief.
- Constraints:
  * Zero filler or conversational padding; strictly focus on metrics, blockers, and decisions.
  * Structure output into exactly 3 sections: (Key Deliverables, Risks & Blockers, Next Sprint Action Items).
  * Explicitly assign an owner and a strict deadline to every action item.
- Required Inputs from Contributor: Raw draft notes, local telemetry/metrics, and target completion dates.
- Pre-Flight Validation Checklist: Is the output under 300 words? Does every decision map to an assigned owner?

When leadership provides this Skill, it acts as a Single Source of Truth for both endpoints:

The Manager guarantees that all constraints are baked in without writing redundant explanations or cluttering communication channels with repetitive instructions.
The Contributor mounts the Skill into their local development environment and asks the model: "Here is the operational Skill; what exact parameters and raw data do you need from me to proceed?".
The Review runs the final output against the exact same Skill before submission, ensuring compliance on the very first pass.

3. The "Apprentice" Metaphor: Unifying Organizational Dialects

To grasp this shift, imagine a field engineer who holds critical operational data and ground-truth metrics, but lacks familiarity with C-suite reporting formats and corporate executive language. Instead of spending months learning formal reporting jargon, they send their sharp apprentice to spend a week at corporate headquarters. The apprentice learns company templates, review criteria, tone, and the exact red flags that cause leadership to reject a proposal.

Once the apprentice returns, the engineer's workflow becomes effortless: provide the raw metrics and technical data, and the apprentice formats it cleanly according to the company’s internal playbook.

In modern workflows: AI is that apprentice.

The shared Skill module is not teaching elementary syntax or general reasoning—the LLM already excels at that. The Skill provides the "Internal Company Playbook": API formatting rules, strict security checks, or client-specific design tokens, delivering compliant outputs without changing the contributor’s core role as the domain expert.

4. Refactoring Roles: Elevating the Contributor

This protocol does not sideline the human engineer into a passive data-entry operator; it formalizes a clear division of responsibilities:

The Manager (Protocol Architect): Translates operational business targets into concrete, machine-readable specifications.
The Contributor (Context Pilot): Provides real-world context, handles edge cases, catches anomalies, and validates the final output.
The AI (Unified Engine): Executes within defined bounds deterministically without contextual drift.

This eliminates "prompt shaming" entirely: AI usage becomes an official, transparent, and auditable engineering workflow rather than an ad-hoc shortcut people try to hide.

5. Organizational Scalability: The 20-Engineer Rule

The true leverage of this architecture becomes obvious at scale. Consider managing a team of 20 developers or designers:

The Traditional Approach: Updating an API spec or security guideline requires meetings, Slack threads, and fighting against 20 divergent interpretations and variable attention spans.
The Skill Protocol Approach: The lead updates two lines in the shared definition file (Skill v1.2) and pushes it to the shared repository. Instantly, all 20 AI environments align with the updated spec with zero drift and zero miscommunication.

AI is far more than a tool for rewriting messages or quietly finishing individual tasks faster. The real 10x leap in productivity lies in standardizing context protocols. By moving from passing loose, ambiguous task descriptions to distributing deterministic Skill modules, we eliminate context degradation and establish an architecture where AI instances coordinate seamlessly within clear human guardrails.

Yii2 Multi-Tenant Auth: How to Support Concurrent Multi-User Sessions in the Same Browser

Braa Al-salahi — Tue, 18 Aug 2026 23:48:10 +0000

Yii2 Multi-Tenant Auth: How to Support Concurrent Multi-User Sessions in the Same Browser

A Comprehensive Guide to Multi-Context Authentication, Real-Time Context Switching, and Session Isolation in Yii2 Framework.

1. Introduction & The Engineering Challenge

In modern web applications built on Yii2 Advanced Framework—such as E-Commerce platforms with a Main Admin Panel and a Merchant/Seller Portal—developers often face a critical requirement:

How can a user log into the Main Admin panel AND a Merchant portal concurrently using two different accounts in the exact same browser without session collisions?

The Core Problem:

Web browsers attach the same session cookie (PHP Session ID) to every HTTP request sent to the same domain. Out of the box, Yii2 relies on a single session key ($_SESSION['__id']) to track the authenticated identity.

When a user logs into the Merchant portal in Tab 2, PHP overwrites $_SESSION['__id'] with the Merchant User ID. The moment the user refreshes Tab 1 (Admin Panel), Yii2 loads the Merchant User identity instead of the Admin, leading to broken authorization, UI glitches, or unexpected logouts.

2. Architecture Overview: Real-Time Dynamic Context Switching

Rather than attempting to hack runtime session names or creating fragile beforeRequest event hooks, the optimal solution introduces a Zero Code Mutation Architecture.

By subclassing yii\web\User and yii\web\Session, we intercept authentication and session access points to perform Real-Time Dynamic Context Switching based on the request URI:

                  ┌──────────────────────────────────────────────┐
                  │                HTTP Request                  │
                  └──────────────────────┬───────────────────────┘
                                         │
                         ┌───────────────┴───────────────┐
                         │   URL Routing Context Check   │
                         └───────────────┬───────────────┘
                                         │
              ┌──────────────────────────┴──────────────────────────┐
              ▼                                                     ▼
   [ Main Admin Route ]                                   [ Merchant Module Route ]
   Context = 'admin'                                      Context = 'merchant'
   ------------------                                     ---------------------
   idParam = '__id'                                       idParam = '__id_merchant'
   Cookie  = '_identity_admin'                            Cookie  = '_identity_merchant'
   Session = $_SESSION['key']                             Session = $_SESSION['merchant_key']
   Flashes = $_SESSION['__flash']                         Flashes = $_SESSION['merchant___flash']

3. Step 1: The Custom User Component (`common\components\User.php`)

We extend yii\web\User to dynamically evaluate the active URL route. Depending on the route context, the component updates $idParam and $identityCookie on the fly and invalidates cached identity objects when switching between tabs.

<?php

namespace common\components;

use Yii;
use yii\web\User as BaseUser;

class User extends BaseUser
{
    private $_lastContext = null;

    public function init()
    {
        $this->applyContext();
        parent::init();
    }

    /**
     * Determines the active application context based on URL path.
     */
    protected function getCurrentContext()
    {
        try {
            if (Yii::$app->has('request')) {
                $path = Yii::$app->request->getPathInfo();
                $merchantPrefix = 'merchant'; // Prefix for merchant routes

                if ($path === $merchantPrefix || strpos($path, $merchantPrefix . '/') === 0) {
                    return 'merchant';
                }
            }
        } catch (\Exception $e) {
        }
        return 'admin';
    }

    /**
     * Applies context-specific idParam and identityCookie configurations.
     */
    public function applyContext()
    {
        $context = $this->getCurrentContext();

        if ($this->_lastContext !== $context) {
            $env = defined('YII_ENV') ? '_' . YII_ENV : '';

            if ($context === 'merchant') {
                $this->idParam = '__id_merchant';
                $this->identityCookie = [
                    'name' => '_identity_merchant' . $env,
                    'httpOnly' => true,
                ];
            } else {
                $this->idParam = '__id';
                $this->identityCookie = [
                    'name' => '_identity_admin' . $env,
                    'httpOnly' => true,
                ];
            }

            // Invalidate identity cache when switching context
            if ($this->_lastContext !== null) {
                $this->setIdentity(null);
            }

            $this->_lastContext = $context;
        }
    }

    // Intercept entry points to ensure context is applied before execution
    public function getIdentity($autoRenew = true)
    {
        $this->applyContext();
        return parent::getIdentity($autoRenew);
    }

    public function login(\yii\web\IdentityInterface $identity, $duration = 0)
    {
        $this->applyContext();
        return parent::login($identity, $duration);
    }

    public function logout($destroySession = true)
    {
        $this->applyContext();
        return parent::logout($destroySession);
    }

    protected function renewAuthStatus()
    {
        $this->applyContext();
        parent::renewAuthStatus();
    }
}

4. Step 2: The Custom Session Component (`common\components\Session.php`)

To prevent generic session data collisions (Yii::$app->session->set('key', $val)) and flash alert mismatches (setFlash), we subclass yii\web\Session.

This component automatically prefixes session keys and isolates flash arrays based on the active context:

<?php

namespace common\components;

use Yii;
use yii\web\Session as BaseSession;

class Session extends BaseSession
{
    /**
     * Returns key prefix based on current route context.
     */
    protected function getContextPrefix()
    {
        try {
            if (Yii::$app->has('request')) {
                $path = Yii::$app->request->getPathInfo();
                $merchantPrefix = 'merchant';

                if ($path === $merchantPrefix || strpos($path, $merchantPrefix . '/') === 0) {
                    return 'merchant_';
                }
            }
        } catch (\Exception $e) {
        }
        return '';
    }

    /**
     * Ensures session status is active before reading/writing.
     */
    protected function ensureSessionActive()
    {
        if (session_status() !== PHP_SESSION_ACTIVE) {
            @session_start();
        }
    }

    // --- Session Key Getters & Setters ---

    public function get($key, $defaultValue = null)
    {
        $this->ensureSessionActive();
        return parent::get($this->getContextPrefix() . $key, $defaultValue);
    }

    public function set($key, $value)
    {
        $this->ensureSessionActive();
        parent::set($this->getContextPrefix() . $key, $value);
    }

    public function remove($key)
    {
        $this->ensureSessionActive();
        return parent::remove($this->getContextPrefix() . $key);
    }

    public function has($key)
    {
        $this->ensureSessionActive();
        return parent::has($this->getContextPrefix() . $key);
    }

    // --- Flash Messages Isolation ---

    public function setFlash($key, $value = true, $removeAfterAccess = true)
    {
        $this->ensureSessionActive();
        $param = $this->getContextPrefix() . $this->flashParam;

        $counters = isset($_SESSION[$param]) && is_array($_SESSION[$param]) ? $_SESSION[$param] : [];
        $counters[$key] = $removeAfterAccess ? -1 : 0;
        $_SESSION[$param] = $counters;
        $_SESSION[$param][$key] = $value;
    }

    public function getFlash($key, $defaultValue = null, $delete = false)
    {
        $this->ensureSessionActive();
        $param = $this->getContextPrefix() . $this->flashParam;

        $counters = isset($_SESSION[$param]) && is_array($_SESSION[$param]) ? $_SESSION[$param] : [];
        if (!isset($counters[$key])) {
            return $defaultValue;
        }

        $value = isset($_SESSION[$param][$key]) ? $_SESSION[$param][$key] : $defaultValue;
        if ($delete) {
            $this->removeFlash($key);
        }

        return $value;
    }

    public function getAllFlashes($delete = false)
    {
        $this->ensureSessionActive();
        $param = $this->getContextPrefix() . $this->flashParam;

        $counters = isset($_SESSION[$param]) && is_array($_SESSION[$param]) ? $_SESSION[$param] : [];
        $flashes = [];
        foreach ($counters as $key => $count) {
            if (isset($_SESSION[$param][$key])) {
                $flashes[$key] = $_SESSION[$param][$key];
                if ($delete) {
                    unset($counters[$key], $_SESSION[$param][$key]);
                }
            }
        }
        if ($delete) {
            $_SESSION[$param] = $counters;
        }

        return $flashes;
    }

    public function removeFlash($key)
    {
        $this->ensureSessionActive();
        $param = $this->getContextPrefix() . $this->flashParam;

        $counters = isset($_SESSION[$param]) && is_array($_SESSION[$param]) ? $_SESSION[$param] : [];
        $value = isset($_SESSION[$param][$key]) ? $_SESSION[$param][$key] : null;
        unset($counters[$key], $_SESSION[$param][$key]);
        $_SESSION[$param] = $counters;

        return $value;
    }

    public function hasFlash($key)
    {
        return $this->getFlash($key) !== null;
    }
}

5. Step 3: Application Configuration (`config/main.php`)

Configure your custom components in backend/config/main.php (or your relevant configuration file):

return [
    'components' => [
        // 1. Custom Session Component
        'session' => [
            'class' => 'common\components\Session',
            'timeout' => 86400 * 30,
            'name' => 'advanced_backend_session',
            'cookieParams' => [
                'httpOnly' => true,
                'secure' => false,
                'lifetime' => 3600 * 24 * 30,
            ],
        ],

        // 2. Custom User Component
        'user' => [
            'class' => 'common\components\User',
            'identityClass' => 'common\models\User',
            'enableAutoLogin' => true,
            'identityCookie' => [
                'name' => '_identity_admin',
                'httpOnly' => true,
            ],
        ],

        // ... rest of your application components
    ],
];

6. Key Benefits & Takeaways

Zero Code Mutation Across Existing Project Code:
- Developers continue calling Yii::$app->user->identity, Yii::$app->user->id, Yii::$app->session->set(), and Yii::$app->session->setFlash() standardly without modifying views, controllers, or widgets.
True Concurrent Multi-User Authentication:
- Users can be signed into an Admin account in Tab 1 and a Merchant account in Tab 2 simultaneously within the same browser.
100% RBAC & Cache Compatibility:
- Standard RBAC managers (yii\rbac\DbManager or custom cached managers) key permission queries by $userId (userAccessCheck:userId:permission), preserving full isolation.

Conclusion

By leveraging object-oriented extension points in Yii2's core architecture (yii\web\User and yii\web\Session), you achieve robust multi-tenant authentication and session isolation elegantly. Happy coding!

DEV Community: Braa Al-salahi

When Both Manager & Employee Use AI, Why Are Results Misaligned?

When Both Manager & Employee Use AI, Why Are Results Misaligned?

1. Deconstructing the Crisis: The Context Loss Loop and "Prompt Shaming"

2. The Architectural Fix: The Shared Skill Protocol

Concrete Skill Blueprint:

3. The "Apprentice" Metaphor: Unifying Organizational Dialects

4. Refactoring Roles: Elevating the Contributor

5. Organizational Scalability: The 20-Engineer Rule

Yii2 Multi-Tenant Auth: How to Support Concurrent Multi-User Sessions in the Same Browser

Yii2 Multi-Tenant Auth: How to Support Concurrent Multi-User Sessions in the Same Browser

1. Introduction & The Engineering Challenge

The Core Problem:

2. Architecture Overview: Real-Time Dynamic Context Switching

3. Step 1: The Custom User Component (common\components\User.php)

4. Step 2: The Custom Session Component (common\components\Session.php)

5. Step 3: Application Configuration (config/main.php)

6. Key Benefits & Takeaways

Conclusion

3. Step 1: The Custom User Component (`common\components\User.php`)

4. Step 2: The Custom Session Component (`common\components\Session.php`)

5. Step 3: Application Configuration (`config/main.php`)