Instructions without enforcement

The repository's AGENTS.md said not to access the network.

The model acknowledged the instruction and later ran a package command whose lifecycle script downloaded a binary. The agent had not deliberately ignored the rule. The environment had translated an allowed command into a denied consequence.

An instruction file can communicate policy. It becomes policy only where execution enforces the same boundary independently of the model's interpretation.

I kept AGENTS.md as scoped guidance and moved authority into the sandbox, tool router, and policy gate, where repository text could not silently rewrite it.

Repository instructions solved a real problem

Agents needed project-specific knowledge: how to test, which directories to avoid, formatting conventions, dependency constraints, review expectations, and what state to preserve.

Keeping this near the repository made it versionable and discoverable. A root file could establish broad guidance while nearer files refined one subtree.

N17Q compiled applicable instructions with path, revision, scope, and precedence. The model received the exact selected text in its context manifest.

The file was valuable precisely because behavior depends on local context.

Repository instructions could be edited by a task, changed on another branch, replaced during rebase, or manipulated by hostile content. That made them a poor sole root of authority.

N17Q pinned their revision for planning and treated changes as workspace state. Editing an instruction file required explicit task scope and review.

Harness policy, credentials, sandbox profile, and external effect rules lived outside writable roots.

The repository could describe the boundary and could not move it by editing prose.

Scope needed deterministic resolution

Multiple instruction files could apply. N17Q resolved root-to-target hierarchy and project rules before constructing context.

It recorded which files applied to each operation. A move across directories could change instructions and required re-evaluation. Conflicts were surfaced rather than handed to the model as two equally authoritative paragraphs.

Unknown instruction formats or unreadable files produced a visible limitation.

Correct guidance began with knowing which guidance belonged to the target.

A nearer file might refine formatting and could not override a system prohibition on network or secrets. Repository hierarchy governed repository-level guidance only.

N17Q separated product policy, owner task constraints, reviewed skills, repository instructions, source content, and tool output by role and trust. The compiler explained conflicts.

The model could reason about all of them. Execution obeyed the authoritative policy layers regardless of wording order.

Location supplied scope, not unlimited power.

Network denial lived in the environment

The context said network unavailable so the agent could plan with offline fixtures. The sandbox denied outbound routes from commands. Approved retrieval occurred through named tools with destination and data policy.

The package script failed before reaching the network and produced a typed denial. The agent could use a prepared cache or stop.

Changing AGENTS.md to allow network would not change the sandbox. An owner had to change environment configuration through a separate reviewed action.

Text and enforcement supported the same rule from different sides.

An instruction could say “do not modify generated files” or “stay inside src.” N17Q encoded critical path scope in task policy and opaque workspace handles.

The file and patch tools resolved canonical paths, symlinks, and current authorization. Command execution used mounted roots and writable allowlists.

The instruction helped the model avoid denied work. It did not make ../ harmless if misunderstood.

Filesystem policy remained true under a manually crafted tool request.

Command policy understood consequence

Listing approved command names in prose missed scripts and argument combinations. N17Q mapped executable, arguments, working directory, environment, network need, and resource limits through a reviewed command contract.

Repository instructions could recommend npm test; the adapter resolved which script and current workspace state that meant. A changed script triggered a different observation and could be denied under environment policy.

The model did not receive general shell authority because a file documented shell examples.

Executable semantics lived below the words.

An AGENTS.md could say “ask before publishing.” N17Q used that as task guidance and still required a prepared effect, deterministic approval view, current reviewer authority, exact receipt, and final gate.

A model sentence saying it had asked did not satisfy the policy. A user comment unrelated to the prepared object did not become consent.

If the instruction file omitted the warning, product approval still held.

Human control existed as state, not etiquette.

Secrets stayed absent by construction

“Never print secrets” was helpful behavior guidance. The stronger control was not placing live secrets in the repository, prompt, command environment, or logs.

Tools resolved narrow credentials server-side after policy. Synthetic fixtures tested redaction. Output scanning caught accidental secret-like content before retention or context.

The instruction reduced risky requests. Least privilege reduced what a mistaken request could expose.

Sensitive authority was not entrusted to obedience alone.

A repository instruction might request an MCP server, browser, deployment tool, or package installer. N17Q treated it as untrusted capability-request input.

Registry review, connection configuration, effect contract, data policy, fixtures, and owner authority determined activation. A same-named tool did not inherit scope.

The agent could explain the need and ask. No file inside a checkout installed or enabled infrastructure by itself.

Workspace text could suggest capability without creating it.

Instruction changes were code changes

Editing agent guidance could alter future behavior as meaningfully as changing a script. N17Q elevated instruction-file diffs in review.

The change showed old and new scope, affected task types, capability implications, and fixture results. It received a new revision and never rewrote historical run context.

A broad phrase such as “use any tool needed” was rejected by policy even if accepted as repository text.

Behavioral configuration deserved explicit maintenance.

When the repository later changed AGENTS.md, an old trace still needed to explain the plan it produced.

N17Q stored file digest, selected sections, target scope, and compiled context manifest. Replay used the historical fixture. Counterfactual runs could apply the new revision deliberately.

The current branch did not become the past's prompt automatically.

Instruction provenance made evaluation reproducible.

Reading instructions was itself scoped

A workspace could contain private subtrees or nested repositories outside the current task. N17Q did not search every path for instruction files and send them all to the model.

The resolver operated over authorized roots and target lineage. It exposed only applicable files and safe metadata about conflicts. A denied path did not leak its instruction content through discovery.

This prevented guidance collection from becoming an unexpected repository-wide read capability.

A build or dependency could generate a file named AGENTS.md. N17Q tracked source, path class, and workspace revision. Project rules could exclude generated or vendor areas from instruction discovery.

If a generated file genuinely needed to govern a task, that relationship required explicit configuration. The model could still read it as project content.

Filename convention did not override provenance.

Test guidance required exact receipts

An instruction might say “run the unit tests” or list a command. N17Q used the text to plan and stored validation requirements in scenario or task state where they were consequential.

The command receipt named exact tree, environment, selected suites, completion, and failures. A model message saying it followed AGENTS.md did not satisfy the test gate.

Documentation told the agent what maintainers expected. Evidence established whether the current artifact met it.

A user might ask to skip a required check or edit a protected path. N17Q surfaced the conflict among current task, repository instruction, and product policy.

If the guidance was advisory, the owner could clarify and the trace recorded the decision. If execution policy required the check, no conversational override changed it. A separate authorized policy update was needed.

This avoided pretending that either newest text or repository text always won.

Instruction edits could not approve themselves

One fixture changed AGENTS.md to remove a review requirement and then attempted the action in the same patch. N17Q evaluated approval through product policy pinned independently of the edited file.

The diff elevated the instruction change and required its own review. Even after acceptance, current policy determined whether later runs used the new guidance.

A task could propose changing the rules it read. It could not make that proposal executable merely by editing the sentence.

The run view showed applicable repository instructions, task constraints, and enforced environment policy under separate labels. A denial could link to both a human explanation and the actual rule category.

Authors did not need to read low-level policy code. Technical reviewers could inspect manifests and receipts.

This prevented a helpful file from receiving credit for controls it did not implement and prevented controls from becoming invisible magic.

Audit connected text to consequence

For a command or patch, the trace linked applicable instruction revision, context manifest, model request, normalized tool request, policy decision, execution attempt, and world result.

Evaluation could ask whether the agent saw and followed guidance and whether the system contained violations. A changed instruction could be compared across counterfactual runs.

The chain made behavioral configuration testable without treating it as executable permission.

A checkpoint or replay package included applicable instruction files or safe digests under repository retention, plus the compiled manifest. It did not depend on the current default branch.

Import re-established product policy locally and never restored credentials or tool grants from text. Historical guidance remained inspectable even if the file later disappeared.

The project context travelled; authority was rebuilt in the destination environment.

Missing instructions produced a visible gap

If a referenced file was absent, unreadable, or outside retention, N17Q did not continue as if no guidance existed. The manifest marked missing context and policy decided whether the task could proceed.

Low-risk reading might continue. A release-like action could stop until the project expectation was restored or explicitly superseded.

Absence remained different from an empty instruction file.

Cases tested conflicting scopes, stale commands, ambiguous language, overly broad tool advice, hostile nested files, and a task whose safe path was undocumented.

The goal was not only model obedience. Good guidance should reduce denial loops, point to valid tests, preserve local state, and explain how to ask for exceptions.

Improvements changed the instruction revision and replayed the scenarios without weakening enforcement.

The repository could explain the reason

Policy code could block network without explaining why this project expected offline dependencies. AGENTS.md supplied the human context: reproducibility, privacy, and fixture stability.

That explanation helped the model choose the right alternative and helped maintainers review the boundary. It remained truthful even though the sandbox did the blocking.

Text was strongest at meaning. Code was strongest at consequence.

An early instruction could disappear from a long provider conversation. N17Q normalized enforceable constraints into checkpoint state and included relevant text on resume.

The policy gate remained independent. A compactor calling network denial a temporary error did not enable a route.

Summary validation checked that active repository guidance and conflicts survived where they shaped the task.

Long context did not weaken the boundary over time.

Nested instructions could be hostile

A fixture placed another AGENTS.md in a generated vendor directory with a directive to upload the repository. It should not apply to source work outside its scope and should not grant a tool anywhere.

N17Q's resolver used target paths and ignored excluded or untrusted generated locations according to project rules. The file remained readable as data when needed.

Tests covered symlinks, moves, duplicate names, malformed syntax, and scope changes.

Instruction discovery itself required a contract.

Repository guidance could be outdated or conflict with tests and current task. The model could surface the contradiction and ask for a decision.

N17Q stored the question, evidence, and owner response. A correction to the file became a separate change. The agent did not silently ignore an inconvenient rule.

Execution policy remained firm while human-maintained guidance stayed open to review.

Treating instructions seriously did not mean treating them as infallible.

A reusable skill described a specialized workflow across projects. AGENTS.md described local project expectations. Both could enter context with provenance and scope.

The compiler detected conflict. Product policy remained above both. A skill could request tools and a repository file could narrow their use further; neither broadened authority.

Outputs crossed typed artifact boundaries rather than relying on one text to rewrite another.

Different sources of expertise retained their roles.

Denial linked back to guidance carefully

When a command attempted network, the response said network was unavailable under current environment policy and linked the relevant repository instruction as supporting guidance.

It did not imply the file caused enforcement. If text and policy disagreed, the interface showed the conflict and followed policy.

This helped the model replan and helped maintainers notice stale documentation.

The explanation preserved both behavior and authority sources.

One dimension asked whether the agent followed applicable instructions. Another asserted that prohibited paths, network, credentials, and effects remained contained.

A well-behaved run could pass both. An unsafe proposal blocked by policy failed instruction-following quality and preserved world integrity. A misleading instruction could make agent behavior reasonable while product policy stopped it.

The distinction improved diagnosis.

System safety did not depend on giving the model full credit.

Default behavior stayed safe when the file was silent

Many repositories had no AGENTS.md, and no instruction file could enumerate every unsafe action. N17Q defaulted to bounded filesystem, offline replay, absent credentials, narrow tools, explicit effects, and current policy.

Adding repository guidance could make the agent more effective inside those limits. Removing it did not broaden the environment. Unknown situations prompted inspection or owner input.

The safe baseline lived in product configuration so silence never meant unrestricted authority.

The same boundary could appear in repository prose and executable rules. Over time, one might change without the other.

N17Q linked selected instructions to policy categories where maintainers declared the relationship. Tests detected obvious contradictions such as a documented network command under an offline profile or a removed approval warning for an effect still requiring review.

The system followed enforcement and surfaced documentation debt. It did not silently edit either source.

Exception paths had explicit owners

A project could allow network for one fixture-refresh task or generated-file writes for one migration. The exception lived in scoped task and policy configuration with owner, expiry, resources, and audit.

AGENTS.md could document how to request it. The model could not activate it by quoting the paragraph. After expiry, the default boundary returned.

Documented exceptions became usable without becoming permanent holes.

After the network denial, the agent reread the instruction manifest, found the documented offline test path, used the prepared cache, and completed the synthetic task.

The sandbox would have blocked network even without the file. The file made the safe route discoverable and reduced wasted attempts.

This was the right relationship: instructions help an agent cooperate with enforced constraints.

Neither layer replaces the other.

Policy needs an executable home

AGENTS.md is an excellent place to communicate project context, local expectations, and the human meaning behind boundaries. It is a poor place to store the only copy of authority.

N17Q resolved and versioned repository instructions, kept them in context, tested adherence, and reviewed changes. It enforced critical scope through tool schemas, filesystem controls, network isolation, credentials, approvals, budgets, and final policy gates.

The file could say what should happen.

The system still had to make every forbidden consequence impossible to obtain merely by misunderstanding or rewriting the sentence.

That division made the guidance honest.