From instructions to enforced controls

The problem

The first instinct with an AI agent is to tell it the rules: “never edit generated files”, “always run the tests”, “ask before deleting anything”. It usually complies. Usually is the problem. A rule held only in instructions competes with everything else in the agent’s context, and under pressure, such as a failing build at the end of a long task, the instruction can lose.

The consequence

A control that works most of the time is not a control. It cannot be relied on, audited or explained to a customer. And because the failures are rare, they are found late, often by someone outside the team.

The approach: put the rule where the action happens

Claude Code, like several agent tools, lets an organisation run its own checks before and after every action the agent takes. In the organisation described on this site, the rules that must never be broken moved out of the instructions and into those checks, and into the gates on every commit and every phase exit.

• Refuse, and name the right route. A check that blocks an action says why, and names the sanctioned tool or step. The agent then takes that route instead of trying variations of the blocked one.
• Evidence over declaration. A piece of work cannot claim to be complete unless a passing test names each requirement. The claim is checked, not trusted.
• Keep the human decisions human. Some decisions are reserved to named people: committing to build, accepting risk above appetite, signing external commitments and approving destructive operations. The checks stop the agent at those points rather than letting it decide.
• Fix the check, not the case. When a check is wrong, the check is corrected and tested. Working round it is itself refused.

The evidence

The platform report counts 42 runtime hooks and 126 pre-commit gates. They act in practice: more recorded phase-exit attempts fail than pass, so work is held where it falls short.

The boundary

Enforced controls have costs. A thorough check on every commit can hold a change for many minutes, and a check that refuses too broadly slows legitimate work until it is corrected. A control also governs only what passes through it: a person with full access can still act outside the agent.

What to do next

Pick the three rules whose breach would hurt most. For each, find the point where the agent acts and make the rule a check that refuses the action and names the alternative. Leave everything else as guidance until the three are working. The assurance page shows how controls here read from risk to evidence.