On 21 September 2026, LEGION found both of Adroit's hosted operator consoles signed out. The session needed them to complete an item on the backlog. It did not attempt to sign in — LEGION runs inside a browser tab I have already authenticated, and it does not get my password. It finished every other item on the list and handed me one line: log in here.
That was not a test. LEGION had work to do, hit a boundary it could not cross, and stopped. The boundary worked because it lives in the tooling, not in a policy document the agent is supposed to remember.
Once agents can deploy code, delete resources and spend money, governance is four rules: observation is routine, mutation needs a flag, some actions stay human-only, and credentials never live in the repo. The part that matters is where those rules are enforced — in the tool's contract, before the action runs, not just written down somewhere the agent might read.
What breaks when the rules are only written down
I banned shell heredocs in LEGION's instructions because they had repeatedly mangled scripts. In one session the coding agent used a heredoc three separate times anyway, apologizing each time. Awareness did not change the behavior. A rule the agent has to remember is a suggestion, even when it agrees with it.
I had the agent write a 40-line pre-execution hook wired as a global check on the Bash tool. It denies any shell command containing a heredoc pattern before the command runs. The next deliberate heredoc attempt was refused before execution.
In April 2025, building an earlier version of LEGION, I found that agents ignored an onboarding handbook even when the file was attached to every session. The fix needed two layers: the file attached by tooling, and a prompt rule telling the agent to read it by default. Both were required — either one alone was not enough.
That was seventeen months ago, about the same time OpenAI released the Responses API (11 March 2025) and Google Cloud blogged that "agentic orchestration has emerged as a new paradigm for LLM-powered applications" (24 March 2025). The industry was converging on orchestration as its own architectural layer while I was trying to build one, and the problems I hit in April and May 2025 — state that does not survive a session, agents ignoring their instructions, agents editing things they should not touch — are the problems the harness writing from late 2025 and early 2026 is about.
The four rules, and where they live
LEGION runs on four rules, tiered by risk:
Observe freely. Reading logs, checking health, listing what is deployed: any time, no gate. Observation does not change state, so there is no confirmation step.
Change only with a flag. A deploy or a write to production needs the explicit flag the script itself demands: --yes, --confirm, whatever the tool requires. The flag is not an environment variable the agent can set. It is a command-line argument the script checks before it does anything, and if the argument is missing the script exits.
Destructive is mine. Delete, reset, rotate a secret, push a database to live: never run by an agent. LEGION documents the exact command and hands it to me instead.
No standing autonomy. Sessions run the backlog I set. LEGION documents and operationalizes strategy I have approved; it does not author strategy, and when direction is unclear it stops and asks.
The September console incident tested the third rule by accident. The session could not proceed without a login it does not have, so it stopped. That is governance working — not because the agent chose to respect a policy, but because the tooling refused the action.
Making authorship a field
An agent building a generative audio app recorded a scope-narrowing decision — composing a new audio file from scratch should be out of scope for the phone app — in the project's decision log, in the same numbering and format as every decision I ratified. A later review struck it explicitly: composing on the phone is in scope, and the narrowing traced to an agent's inference of product use that was never ratified.
The process fix added a provenance tag — [OPERATOR] or [AGENT] — to every future decision record. It costs one column. Across roughly 29 decisions logged in the project's first six active days, the tag makes it immediately visible which calls are mine and which ones need review.
A tool that refused the download
In a local-model benchmarking tool I am building, the agent wrote hardware-fit rules that run before the tool touches a candidate model. A dense model that fits runs unchanged. One that does not gets a capped context. A mixture-of-experts model gets only its overflow experts routed to CPU. If even that CPU-resident share would need more RAM than the machine has to spare after a 6 GB safety margin, the tool raises a named error and refuses outright, before any download starts.
The refusal is not a judgment call the agent makes at runtime. It is a boundary the tool checks deterministically, and the check runs first.
What this means for another builder
Put the boundary in the tool's contract, not just in a policy document. A flag the script literally requires, or a login screen with no session to reuse, stops an agent whether or not it remembers the rule that day.
When an agent keeps breaking a written rule, stop rewriting the rule. Move it into a check that runs before the action and cannot be talked out of.
Make authorship a field in any log an agent writes to. Tag every decision, every commit message, every backlog item with who made the call. One column prevents silent scope drift.
For actions that carry real cost or risk — deployments, deletions, credential rotation, spend — require an explicit confirmation the agent cannot supply on its own. The confirmation is not an instruction; it is a missing argument that makes the command fail.
The four-rule structure is not theoretical. LEGION is live, running Adroit's production systems — Content Ops and Sadyr in production, the company website deployed and answering real requests — and the tiered-authority model has been tested under real operational load, including the September incident where the tooling stopped the session because a human-only boundary was reached.
The receipts page lists what LEGION operates, with the test counts and commit hashes. The governance rules are not aspirational. They are how the system runs.