Prose Is Not a Control

A sentence in AGENTS.md is not a control. Tools that never read the file will cheerfully violate it while passing every check they have. If a boundary matters (privacy, send rights, scope), enforce it in code and fail the build when it breaks.

I already believed "draft, don't send" had to be mechanical. Then I watched a quieter failure: two tools promoted a private journal passage into derived claim files. They were not malicious. They did exactly what they were written to do. The rule that should have stopped them lived in prose. Neither tool reads prose.

That week taught the title: prose is not a control.

What prose is good for

Prose is excellent for:

• Teaching humans the why
• Aligning a team on definitions
• Explaining a charter in review
• Capturing voice and taste

Prose is a terrible sole enforcement layer for:

• Auto-send
• Copying sensitive domains into digests
• Promoting drafts into evergreen claims
• Exfiltrating secrets into chat
• Speaking as a human in outbound channels

If the bad action is one function call away, the guard must be one function call earlier.

The scope-guard pattern

In my personal harness, some life domains stay lived, not modelled. The journal can hold them. Derived artefacts must not copy them into shareable claim files.

The control that worked:

1. A library function that refuses to copy matched passages into derived outputs
2. Transparency: count what was withheld and point back at the entry (no silent censorship theatre)
3. Evals that fail if the guard regresses
4. Relational tests, not only keyword lists (tidy keywords miss human sentences)

The first guard failed on a line that named no listed keyword. That is the point of evals. Humans write messily. Guards that only work on tidy prose are decorative.

I am keeping the example abstract on purpose. The lesson is the control plane, not the diary.

Sibling controls builders should ship

RivaFlow and photography pipelines get the same treatment: consent folders and house style are checks, not vibes. BJJ training notes can be rich in the private log and still refuse promotion into public essays without a human gate.

SMB to enterprise

SMB: You do not need a platform team. You need three things: a must_not list in code for your agent tools, a draft flag that cannot be overridden by prompt charm, and one eval folder that runs in CI or pre-commit.

Enterprise: Policy wikis without enforcement are how incidents become slideware. Map each high-severity wish to:

• a preventive control
• a detective control
• an eval or audit artefact
• an owner

"AI code of conduct" without tool-level gates is prose. Treat it as training material, not as the control.

How to install a guard in a day

Morning: pick one boundary that already bit you (send, PII, private domains, spend).
Midday: implement refuse-to-copy or refuse-to-send at the tool boundary.
Afternoon: write three eval cases, including one that almost slips through.
Evening: break the guard on purpose, watch the eval fail, restore it. Ship.

If you cannot afford a day, you cannot afford the incident either.

Failure modes

• More policy documents after a miss
• Keyword-only filters on human text
• Silent drops with no withheld count
• Guards editable by the agent they constrain
• Celebrating a demo that bypasses the gate "just this once"

Closing

Builders like writing constitutions for agents. Constitutions are useful. They are not locks.

Put the scope-guard in code. Prove it with evals. Keep the prose for humans who need the why.

That is how a twin stays a twin, how a morning brief stays safe, and how a $50 AI company stays out of the newspaper.