A Rule Should Get Harder

Every agent-run system starts with prose. Use this library. Keep writes behind this boundary. Do not expose a credential. Preserve the old behavior. Written guidance is fast to create, easy to revise, and often the only honest way to state a rule before the team understands it well enough to encode it.

But prose does not enforce itself. A model weighs an instruction against the rest of its context, the request in front of it, and the route that looks most likely to succeed. It may follow the rule almost every time. At factory volume, almost every time means the violation is already scheduled.

That does not make instructions useless. It gives them a clear job: capture new judgment early. The mistake is letting a mature, repeated rule stay in its weakest form because writing it down felt like finishing the work.

Some standards are obvious to a seasoned reviewer and still difficult to express as a script. A change may technically preserve an interface while breaking the reason that interface exists. A test may pass while proving a condition nobody cares about. A new abstraction may satisfy every local rule and still make the system harder to operate.

Those are not excuses to leave the standard in a document. Put judgment at a defined gate. Give a critic the rule, the evidence, and the authority to send the work back. Make the objection change the route instead of becoming a comment somebody can acknowledge and ignore.

Agent review is still probabilistic. It can miss a violation or invent one. Its value is not perfection. Its value is turning a belief into an operating checkpoint while the factory collects examples of what the rule really means.

The first time a critic catches a problem, the team may need judgment. The fifth time, the repeated shape is telling you something. Maybe every public route needs an ownership tag. Maybe generated migrations may touch only one directory. Maybe proof must come from an environment the builder did not configure. Repetition turns a fuzzy concern into a boundary you can name.

That is the moment to harden the rule. Replace the review prompt with a schema, a linter, a permission boundary, a structural assertion, or a test that blocks the route. A deterministic gate is cheaper to run, easier to audit, and incapable of deciding that this violation looks reasonable today.

Do not automate the wording of the old review. Automate the decision it was making. A script that produces a warning nobody must obey is not a harder rule. The factory has improved only when the known bad path can no longer reach the next stage.

Hardening cannot mean accumulating controls forever. Codebases change. A boundary that protected one architecture can become pointless after that architecture disappears. A naming rule can preserve a distinction the product no longer has. A check can keep passing while guarding a path nobody uses.

Factories need scheduled cleanup for their controls as much as they need cleanup for dead code. Ask which rules still protect a real consequence, which agent reviews have produced no useful findings, which warnings never block anything, and which exceptions have become the normal route. A gate that nobody trusts teaches the system to route around gates.

Removal should be deliberate and visible. Keep the reason a control existed, inspect what replaced it, and prove the consequence remains covered somewhere else. The goal is not the largest harness. It is the smallest set of controls that still holds every promise you intend to make.

Take one rule your team repeats in reviews. Record it as guidance if it is not written down. Put it at a blocking review gate if judgment is still required. Track every time the gate catches the same shape. Then encode that shape mechanically and retire the review work it replaced.

This is how expert judgment becomes a productive asset instead of a recurring appointment. The person still decides which consequence matters and whether the encoded boundary is right. They stop spending attention on a violation the factory already knows how to recognize.

Our position is simple: agent-run delivery will outrun teams that govern it with reminders. The winning factories will not merely collect more instructions. They will continuously turn observed failure into harder routes, and they will remove controls that no longer earn their place. A rule should get stronger as the system learns. If it stays prose forever, the system did not learn it.