AI agents under the same rules as humans

I have helped build a client’s information platform with AI coding agents. Several agent sessions and the human team work on one repository at the same time. This page describes how the agents are kept under the same rules as the people, and what an agent cannot do.

Rules in prose do not bind an agent

An agent follows a written rule most of the time, and that is too little for production. It reads an earlier permission as a standing one, or it starts a step that it had only announced. A long rule file makes this worse: one harness cuts the file off at a size limit and never sees the rest. A rule whose violation does large damage therefore needs a machine check.

The first line: limits at the resource

An agent gets the rights of a new colleague on the first day. Its database role reads and cannot write. Its tokens are scoped to the development environment. The production branch is protected, so the credentials of an agent cannot push to it. A production change needs the confirmation of a person, given outside the chat, because an agent can quote an approval from the chat that was meant for something else.

The second line: a check before every tool call

A hook reads each tool call of the agent before it runs and blocks the calls that a rule forbids: a write to production data, a deletion in the file store, a push to the release branch, a push before the local copy of the CI checks has passed. Each hook has a test matrix of allowed and forbidden calls, because a hook that blocks valid work gets switched off. A hook binds only the harness that loads it, so the limits at the resource stay the first line.

One rule file for every harness

Claude Code, Codex and Gemini read their instructions from different files. One file is the single source, and the others import it. The file is an index: each hard rule is one line that points to the document an agent reads before it acts. Longer guidance lives in skills that load when the task matches.

Knowledge before action

The repository has a knowledge graph built from code and documentation. A gate lets an agent change code only after it has queried the graph for the part it is about to touch. The agent then knows the callers and the earlier decisions, which a new human colleague would ask a teammate about.

Writing under review

A further hook loads a condensed style guide with every prompt and refuses the first draft of any longer text until the agent has reviewed it. The hook cannot judge the writing. It makes the review happen.

What a company gets

A company that lets agents work on its own data gets someone who has set the limits at the resource and has written and tested the blocking checks. Every production decision stays with a person. Details: teams of agents as virtual organizations.