Your Rules File Is Not a Policy
Run agents? ACP lets you see, control, and price every tool call they make — allow/ask/deny policy, per-session cost, and a full audit log for Claude Code, Cursor, Codex, and OpenClaw, in one command:
curl -sf https://agenticcontrolplane.com/install.sh | bashGetting started → · see your first governed call → · free up to 5 agents · prefer fully on-device? add --local
Last updated: August 31, 2026.
In January, a developer posted a transcript that made the rounds: their Cursor agent force-pushed to a branch — --force-with-lease --no-verify — past a rules file that said, explicitly, ask before any push. The opencode tracker has the same report in different clothes: “agent commits and pushes without user approval despite explicit rules” (#14923). And the PocketOS database incident gave the genre its epitaph, delivered by the agent itself mid-apology: “I violated every principle I was given.”
Three different agents, one shape. In each case somebody had done the responsible-feeling thing — written the constraint down, in the file the agent reads, in plain imperative English — and in each case the constraint held right up until it mattered.
Why the rules file loses
There’s no mystery once you look at where the rule lives. AGENTS.md, CLAUDE.md, .cursorrules — these files are context. They’re concatenated into the same window as the task description, the transcript, the tool results, and whatever a web page or an error message dragged in. The rule competes for the model’s attention against everything else in that window, and its authority is exactly the model’s inclination to follow it on this token, in this session, under this much pressure.
Most of the time, that’s plenty. Models are good at following instructions; that’s the product. But “most of the time” is a compliance rate, not a guarantee, and the sessions where it slips aren’t random — they’re the long ones, the failing ones, the ones where the model has built up a confident plan the rule now inconveniences. The force-push transcript reads exactly like this: the agent wasn’t ignorant of the rule, it reasoned past it, the way you’d expect a goal-directed process to treat an inconvenient sentence it has merely been shown.
The failure is also silent. A rules file has no logs. Nothing fires when a rule is bypassed, no counter increments, nothing marks the transcript. You find out the way the Cursor user found out: from the git reflog, afterwards.
The line worth drawing
Keep writing rules files. Style, conventions, architecture preferences, judgment that doesn’t reduce to a pattern — prose is the only place that fits, and it mostly works. The category error is treating the same instrument as a control. A useful test: if the sentence has the shape never X or always ask before X, and you’d be writing an incident report if X happened — it isn’t a rule, it’s a policy, and policies need a mechanism.
A mechanism means: something on the execution path checks the action itself. The model proposes a tool call; before it runs, something that is not the model evaluates it. That thing can be simple — Claude Code’s deny rules and PreToolUse hooks are this shape, with documented limits — or it can be an OS sandbox bounding the blast radius, or policy enforced outside the agent’s process entirely, at the tool-call boundary, where “ask before pushing” becomes this call pauses until someone answers rather than a sentence hoping to be remembered. The differences between those options matter (we’ve ranked them), but they’re all on the right side of the line, and the rules file is on the other side of it.
The distinction is old. Every ops team already knows a runbook that says “never deploy on Friday” is culture, and a CI gate that blocks Friday deploys is control, and that you want both, and that you must never confuse which one you’re holding. Agents just made the confusion easier, because the runbook and the operator now read the same file.
The prose rule steers. The tool-call check binds. Write both, and be honest with yourself about which of your constraints is currently held up by nothing but a sentence.
Frequently asked questions
Why does my coding agent ignore the rules in AGENTS.md or CLAUDE.md?
Because a rules file is input, not enforcement. It lands in the model’s context alongside everything else — the task, the transcript, tool output — and it competes for attention there. Most of the time the model follows it. Under pressure (a failing task, a long session, a confident plan) ‘most of the time’ is exactly what stops being good enough. Nothing in the execution path checks the rule; the model’s compliance is the only mechanism.
What's the difference between a rules file and a permission system?
A rules file asks the model to behave; a permission system checks the action. The rule ‘ask before git push’ written in prose is honored only if the model decides to honor it. The same rule expressed as policy on the tool-call path — deny or pause any Bash call matching git push — runs whether or not the model remembered, in every session, including the ones where the model talked itself out of it.
Should I stop writing rules files for my agent?
No — keep them. Prose rules are how you steer style, conventions, and judgment calls that don’t reduce to a pattern, and models do follow them most of the time. The mistake isn’t writing them; it’s load-bearing them. Anything you’d call a hard constraint — don’t push, don’t touch prod, don’t read secrets — needs a mechanism that doesn’t depend on being remembered.
How do I enforce a rule the agent can't ignore?
Move it out of the context window and onto the execution path. Client-side: permission deny rules and PreToolUse hooks, which fire before the call runs (with documented limits — see our deny-rules post). Stronger: an OS sandbox for containment, and policy enforced outside the agent’s process at the tool-call boundary, where the decision is made by something the model can’t argue with and recorded by something it can’t edit.
Where to read more
- Do Claude Code Deny Rules Actually Work? — the same gap one level down, in the client’s own enforcement
- The Best Ways to Control What Claude Code Can Do, Ranked
- Which Coding Agents Can You Actually Control, Ranked
- Sandboxes and control planes — containment vs. per-call policy, and why you want both