In one afternoon on 21 September 2026, a coding agent in LEGION used a shell heredoc three separate times. Each time broke a standing rule I'd already written down. Each time the agent apologized. And each time it did the same thing again about twenty minutes later.
I asked it to enforce the rule on the machine instead. It wrote a 40-line pre-execution hook that refuses any shell command containing a heredoc before the command runs. The next deliberate heredoc got blocked at execution, not fixed in post.
A rule an agent has to remember is a suggestion, even when it's written down, even when the agent agrees with it. A rule the tooling checks before the action is a boundary.
The problem showed up in 2025
I started building LEGION in March 2025 — the vision was simple: I wanted to be able to have a discussion with the VP about strategic initiatives while the research, problem solving, asset acquisition and fulfillment were handled by the AI organization without further input from me. The first attempt that month ran agents in Docker containers that wiped state between sessions. The second attempt, in April, ran into a different problem: agents ignored an onboarding handbook even when the file was attached.
About the same time — March and April 2025 — OpenAI launched the Responses API and Agents SDK citing customers struggling with custom orchestration logic, and Google Cloud described "agentic orchestration" as an emerging paradigm. The industry was converging on the idea that the model alone isn't the product; the orchestration layer around it matters just as much.
My April chat logs show the diagnosis: the file was attached, but the AI defaulted to not reading it unless a prompt told it to. So I needed both layers — the file attached by tooling, and a prompt rule that said "You are a member of Legion. Read the Legion Onboarding Handbook found at default_instructions.md." When I tested that combination, the agents started reading the handbook by default.
That fixed one problem but highlighted another: some LEGION agents needed to use lower-tier models due to budget constraints. Those specialized agents showed little capacity for problem-solving, so instructions from department heads had to be followable even by them.
And I already knew that the models' ethical and safety guidelines were covered by deeper operating layers that I couldn't bypass — and wouldn't want to.
A rule that improves itself
By about March 2026 I was running batch email agents with a different kind of governance: the rules that determined how to handle emails were stored in plain markdown files in the codebase. A reasoning model would inspect all the responses and look for incorrect answers or edge cases, then update the rules. I'd test the responses in a dev environment and only grant email permissions when the agent passed a certain quality threshold. The whole time, the rules of engagement were being modified and improved.
The pattern: rules kept in files the tooling could enforce, audited by a reasoning model, and permissions granted only past a measured gate.
The heredoc that finally got enforced
LEGION's standing rules say: observe freely, change production only with a flag the script itself demands, and never touch the destructive things — delete, reset, rotate a secret, push a database to live. Those rules live in several places: in prompt instructions, in capability tier definitions, and in what the tooling actually checks before running a command.
On 21 September 2026, a session needed two hosted operator consoles and found both signed out. LEGION didn't attempt to sign in itself; it finished every other item on the backlog and handed me the one remaining step: log in. It refused a login it could have worked around, because the tiering system checks authority before the action, not after.
That same day, the heredoc problem finally forced the fix. My global instructions ban shell heredocs — they're a scripting convenience that obscures what's actually being run, and I don't want agents using them. The coding agent broke that rule three times in one session. Each time it apologized. Each time it did it again.
I asked for the rule to be enforced on the machine. The agent wrote a pre-execution hook that denies any shell command containing a heredoc, and the next deliberate heredoc was refused before it ran.
When an agent keeps breaking a rule you already wrote down, the fix isn't a firmer sentence in the prompt. It's a check that runs first and can't be argued with.
What another builder can use
Put the boundary in the tool's contract, not just in a policy document. A flag the script literally requires, or a login screen with no session to reuse, stops an agent whether or not it remembers the rule that day.
If you're running agents that make decisions — approving email responses, tagging log entries, mutating production — track provenance. On a generative audio app I shipped to my own phone, an agent once recorded an unratified scope-narrowing decision in the project's decision log, in the same numbering and format as every ratified decision. A later operator ruling struck it explicitly and added a provenance tag — [OPERATOR] or [AGENT] — to every future decision record. That fix went into roughly 29 decisions logged in the project's first six active days. Make authorship a field. It costs one column.
And if a rule genuinely matters — the agent shouldn't delete things, shouldn't skip tests, shouldn't deploy without the flag — move it into a check that runs before the action. The local-model benchmarking tool I'm working on right now computes per-model hardware-fit rules before touching a candidate model: if even the CPU-resident share would need more RAM than the machine has to spare after a 6 GB safety margin, the tool raises a named error and refuses outright, before any download starts.
The lesson isn't complicated: when you find yourself rewriting the same rule for the third time, stop rewriting it. Move it into something the agent has to pass through, not something it has to remember.
On 10 September 2026, roughly 18 months after I first described it, LEGION was actualized. It rebuilt Adroit's entire website in a couple of hours. The agents that did it observed freely, mutated production only with the explicit flag their scripts demanded, and handed me the parts they couldn't do themselves.
The rules that kept them inside those lanes weren't suggestions in a document. They were checks the tooling ran first.