Constitutions grow as prose. Every incident becomes a clause, every clause goes into the instructions file, and one day the AI must read an entire wall of rules before writing a line — so it skims, and the rules it skims are the ones it breaks. Anthropic's own docs say it plainly: an instruction like "never edit .env" in an instructions file is a request, not a guarantee; a hook that blocks the edit is enforcement.
The fix is not writing the rules better. It is moving each rule from paper to hardware.
The conversion table
| Standing rule shaped like… |
Becomes |
| "Before touching X, read spec Y" |
A path-scoped rule file (.claude/rules/*.md with paths: frontmatter) — loads only when the AI touches matching files, invisible otherwise |
| "Never do X without approval" |
A PreToolUse gate that intercepts the tool call — ask, not deny, so legitimate work passes with one confirmation |
| "Always report X when finished" |
A Stop gate that checks the final message and bounces it back — capped at once per session so it can never loop |
| "The mapping between A and B" |
A routing script that computes the answer from the source of truth at run time — never a hand-written copy |
Hard rules
- Rule files route; they never restate. A summary of a spec is a second source of truth, and it will drift. Each rule file holds pointers ("read section 4 of spec Y") plus at most a handful of negative gates ("feature Z was deleted — don't resurrect it"). If you catch yourself paraphrasing the spec, stop.
- Fire every gate before trusting it. Feed it the bypasses on purpose: uppercase paths,
./ and ../ tricks, absolute paths from a worktree, the field name a different tool uses. A gate you never saw block is a decoration — the same red-light principle you apply to tests, applied to config. Our first report-gate matched a skip-pattern on exactly the directory all real work happens in; it would never have fired once.
- Budget the founder's friction. Every gate that pings a human must be worth a human-minute. Gate only what the founder personally must approve; everything else stays silent. Our founder's line, now law: anything that adds my workload is the wrong direction. We shipped a gate on test-file edits and repealed it the same day — too chatty, no danger.
- Anything that must survive a machine switch goes in git. Local memory is machine-local: our cloud sessions had read zero of the lessons the founder spent weeks teaching, because every one lived in one laptop's memory directory. If a rule should hold on any machine, it is a checked-in file, not a memory.
- Config is decision-grade output — it gets reviewed like code. Have a different model try to break it, with only the requirements and the artifacts (never the author's reasoning). Ours returned FAIL: three bypasses, one gate that could never fire, and a false fact the author had copied into a spec without checking the code.
- Scaffolding dies the day its question is answered. Diagnostic hooks, verification loggers, one-off probes: remove them the moment they've proven the point. Mechanisms you keep must earn their keep forever.
What good looks like
Session start injects a few hundred bytes of live status, not a constitution. Specs load by the section, when the file they govern is touched. The two or three rules that truly need a human land as one confirmation dialog each. Everything else is silence — until the day a session tries the forbidden thing and the gate catches it in the act.
Full story with numbers: case-studies/rules-as-mechanism-campaign.md
1---2name: rules-as-mechanism3description: A rule written in prose is a request; a rule wired into the harness is a guarantee. Use when a standing rule has been broken twice, when session-start context keeps growing, or when the AI must read huge specs before it can safely touch code.4---56Constitutions grow as prose. Every incident becomes a clause, every clause goes into the instructions file, and one day the AI must read an entire wall of rules before writing a line — so it skims, and the rules it skims are the ones it breaks. Anthropic's own docs say it plainly: an instruction like "never edit .env" in an instructions file **is a request, not a guarantee**; a hook that blocks the edit is enforcement.78The fix is not writing the rules *better*. It is moving each rule from paper to hardware.910## The conversion table1112| Standing rule shaped like… | Becomes |13|---|---|14| "Before touching X, read spec Y" | A **path-scoped rule file** (`.claude/rules/*.md` with `paths:` frontmatter) — loads only when the AI touches matching files, invisible otherwise |15| "Never do X without approval" | A **PreToolUse gate** that intercepts the tool call — `ask`, not `deny`, so legitimate work passes with one confirmation |16| "Always report X when finished" | A **Stop gate** that checks the final message and bounces it back — capped at once per session so it can never loop |17| "The mapping between A and B" | A **routing script** that computes the answer from the source of truth at run time — never a hand-written copy |1819## Hard rules2021- **Rule files route; they never restate.** A summary of a spec is a second source of truth, and it *will* drift. Each rule file holds pointers ("read section 4 of spec Y") plus at most a handful of negative gates ("feature Z was deleted — don't resurrect it"). If you catch yourself paraphrasing the spec, stop.22- **Fire every gate before trusting it.** Feed it the bypasses on purpose: uppercase paths, `./` and `../` tricks, absolute paths from a worktree, the field name a different tool uses. A gate you never saw block is a decoration — the same red-light principle you apply to tests, applied to config. Our first report-gate matched a skip-pattern on exactly the directory all real work happens in; it would never have fired once.23- **Budget the founder's friction.** Every gate that pings a human must be worth a human-minute. Gate only what the founder personally must approve; everything else stays silent. Our founder's line, now law: *anything that adds my workload is the wrong direction.* We shipped a gate on test-file edits and repealed it the same day — too chatty, no danger.24- **Anything that must survive a machine switch goes in git.** Local memory is machine-local: our cloud sessions had read *zero* of the lessons the founder spent weeks teaching, because every one lived in one laptop's memory directory. If a rule should hold on any machine, it is a checked-in file, not a memory.25- **Config is decision-grade output — it gets reviewed like code.** Have a different model try to break it, with only the requirements and the artifacts (never the author's reasoning). Ours returned FAIL: three bypasses, one gate that could never fire, and a false fact the author had copied into a spec without checking the code.26- **Scaffolding dies the day its question is answered.** Diagnostic hooks, verification loggers, one-off probes: remove them the moment they've proven the point. Mechanisms you keep must earn their keep forever.2728## What good looks like2930Session start injects a few hundred bytes of live status, not a constitution. Specs load by the section, when the file they govern is touched. The two or three rules that truly need a human land as one confirmation dialog each. Everything else is silence — until the day a session tries the forbidden thing and the gate catches it in the act.3132Full story with numbers: [case-studies/rules-as-mechanism-campaign.md](../../case-studies/rules-as-mechanism-campaign.md)
lightarktech