# Rules As Mechanism

> A rule written in prose is a request; a rule wired into the harness is a guarantee. Use when a standing rule has been broken twice, when session-start context keeps growing, or when the AI must read huge specs before it can safely touch code.

- Skill: `lightarktech/rules-as-mechanism` (Agent Skill)
- Install (CLI): `npx skillmds@latest add lightarktech/rules-as-mechanism`
- Raw SKILL.md: https://api.skillmd.com/api/skills/lightarktech/rules-as-mechanism/raw
- Safety review: pending
- Works with: Claude Code, Claude.ai, OpenAI Codex
- Category: Coding & Dev Tools
- Author: lightarktech (https://skillmd.com/u/lightarktech)
- Updated: 2026-09-17
- Page: https://skillmd.com/skills/lightarktech/rules-as-mechanism

---


Constitutions grow as prose. Every incident becomes a clause, every clause goes into the instructions file, and one day the AI must read an entire wall of rules before writing a line — so it skims, and the rules it skims are the ones it breaks. Anthropic's own docs say it plainly: an instruction like "never edit .env" in an instructions file **is a request, not a guarantee**; a hook that blocks the edit is enforcement.

The fix is not writing the rules *better*. It is moving each rule from paper to hardware.

## The conversion table

| Standing rule shaped like… | Becomes |
|---|---|
| "Before touching X, read spec Y" | A **path-scoped rule file** (`.claude/rules/*.md` with `paths:` frontmatter) — loads only when the AI touches matching files, invisible otherwise |
| "Never do X without approval" | A **PreToolUse gate** that intercepts the tool call — `ask`, not `deny`, so legitimate work passes with one confirmation |
| "Always report X when finished" | A **Stop gate** that checks the final message and bounces it back — capped at once per session so it can never loop |
| "The mapping between A and B" | A **routing script** that computes the answer from the source of truth at run time — never a hand-written copy |

## Hard rules

- **Rule files route; they never restate.** A summary of a spec is a second source of truth, and it *will* drift. Each rule file holds pointers ("read section 4 of spec Y") plus at most a handful of negative gates ("feature Z was deleted — don't resurrect it"). If you catch yourself paraphrasing the spec, stop.
- **Fire every gate before trusting it.** Feed it the bypasses on purpose: uppercase paths, `./` and `../` tricks, absolute paths from a worktree, the field name a different tool uses. A gate you never saw block is a decoration — the same red-light principle you apply to tests, applied to config. Our first report-gate matched a skip-pattern on exactly the directory all real work happens in; it would never have fired once.
- **Budget the founder's friction.** Every gate that pings a human must be worth a human-minute. Gate only what the founder personally must approve; everything else stays silent. Our founder's line, now law: *anything that adds my workload is the wrong direction.* We shipped a gate on test-file edits and repealed it the same day — too chatty, no danger.
- **Anything that must survive a machine switch goes in git.** Local memory is machine-local: our cloud sessions had read *zero* of the lessons the founder spent weeks teaching, because every one lived in one laptop's memory directory. If a rule should hold on any machine, it is a checked-in file, not a memory.
- **Config is decision-grade output — it gets reviewed like code.** Have a different model try to break it, with only the requirements and the artifacts (never the author's reasoning). Ours returned FAIL: three bypasses, one gate that could never fire, and a false fact the author had copied into a spec without checking the code.
- **Scaffolding dies the day its question is answered.** Diagnostic hooks, verification loggers, one-off probes: remove them the moment they've proven the point. Mechanisms you keep must earn their keep forever.

## What good looks like

Session start injects a few hundred bytes of live status, not a constitution. Specs load by the section, when the file they govern is touched. The two or three rules that truly need a human land as one confirmation dialog each. Everything else is silence — until the day a session tries the forbidden thing and the gate catches it in the act.

Full story with numbers: [case-studies/rules-as-mechanism-campaign.md](../../case-studies/rules-as-mechanism-campaign.md)