Why do rules in CLAUDE.md or a system prompt get ignored?

Because they are advice, and an agent under load weighs advice against everything else in its context. Spotify put routing rules in CLAUDE.md, Claude read them and ignored them, and every project needed its own copy. A PreToolUse hook that blocks the call is not weighed against anything. The difference is not wording. It is whether something outside the model stops the action.

What makes a decision observable at a chokepoint?

The inputs to the decision exist before the action and can be read without interpretation. A file path and a line count. A dollar amount on a transaction. A destination domain on a request. Whether a block of code is boilerplate, whether a summary is faithful, whether a customer request is reasonable: none of those are visible at the gate, so none of them can be enforced there.

Where should the enforcement point live?

Somewhere calls already pass through for another reason: credential injection, egress filtering, audit logging. If you own the runtime, the proxy that injects credentials at call time is the natural chokepoint, and routing policy belongs there as server-side data per tenant. If you have to build a new chokepoint just to enforce one rule, that is a signal you are dealing with a preference.

How does reversibility fit in?

It is the third question and the one that decides how strict the gate can be. A blocked file read costs thirty seconds, so a crude gate is fine. A blocked design decision costs the design, so there is no acceptable false-positive rate and the rule has to stay advisory. This is the same gate I argue for on agent autonomy generally: not how confident the model is, but how bad it is if wrong and whether you can take it back.

What is the hidden cost of routing to a cheap model?

Trust. Spotify's cheap model missed a thread-safety bug the frontier model caught at once. For code that is a review problem. For ingestion or extraction, a fact from a cheap model stored at the same confidence as a frontier or human-confirmed fact turns a cost decision into a trust decision nobody made on purpose. Record the tier that produced each fact and let it shape downstream trust, and never let a cheap verifier clear an action that is expensive to undo.

When a Rule on an AI Agent Is Enforceable

When can you actually enforce a rule on an AI agent?

THE SHORT ANSWER

When the decision is observable at a chokepoint every call already passes through, can be decided without the agent's reasoning, and is cheap to reverse if wrong. Two of the three and you can build a gate. Spotify's shunt plugin is the clean case: a hook blocks any file read over 350 lines because a path and a line count are visible before the read happens, but the boilerplate-writing path stays advisory because whether a piece of code is boilerplate or design is a judgment the gate cannot make without doing the reasoning it was meant to avoid. Their first attempt, rules in CLAUDE.md, was ignored. A rule that fails the test is a preference, however firmly it is written, and the honest move is to know which one you are holding.

The test is short enough to run on every rule you have written for an agent this year.

Is the decision observable at a chokepoint every call already goes through? Can it be decided without the agent's reasoning? Is it cheap to reverse if wrong? Two yeses and you can build something that stops the agent. Fewer, and what you have written is documentation.

Spotify's shunt plugin is the cleanest public example of both halves at once. The read path is a gate because a line count is a fact. The write path is a suggestion because "is this boilerplate" is a judgment. Same team, same plugin, same intent, and the README is honest that only one of the two is enforced.

The post above takes the argument into where the gate should live when you own the runtime, and into the trust problem that cheap-tier routing creates for any system that keeps what the cheap model produced.

Last reviewed 2026-09-17 · 1 min read

When can you actually enforce a rule on an AI agent?

SOURCES

THE LONG VERSION

RELATED ANSWERS