A large-scale study of AI agent instructions finds that written rules alone are not enough—effective enforcement increasingly depends on context, system state, and controls operating beneath the agent itself.
By The Grey Ghost
WHAT’S HAPPENING
Researchers behind ActPlane analyzed 2,116 policy statements across 64 popular software repositories containing CLAUDE.md and AGENTS.md instruction files.
The study examined whether rules written for AI coding agents could actually be observed, evaluated, and enforced by the underlying system.
The central finding: many policies that appear simple in natural language become far more complicated when a system must determine exactly when, where, and under what circumstances they apply.
WHY IT MATTERS
AI agents are increasingly being given permission to modify files, execute commands, interact with networks, and perform multi-step software tasks.
Written instructions can guide those agents, but guidance is not the same as enforcement.
Many policies depend on information such as repository structure, previous actions, task progress, or changes that occur across multiple events. That makes simple allow-or-block rules insufficient for some real-world agent behavior.
As AI agents receive broader system access, the ability to convert human instructions into enforceable technical controls could become an important part of AI security.
WHO BENEFITS
Software developers gain stronger mechanisms for controlling what autonomous coding agents can do.
Cybersecurity teams gain additional enforcement layers beyond relying on an AI model to follow written instructions voluntarily.
Enterprises deploying AI agents could gain more predictable behavior when agents interact with sensitive systems, files, and networks.
AI platform developers gain a framework for translating natural-language policies into machine-enforceable controls.
WHO LOSES
Organizations relying solely on prompt-based safeguards may discover that written policies provide less protection than expected.
AI systems without contextual monitoring could struggle to determine when otherwise legitimate actions violate project-specific rules.
Developers may also face additional complexity as agent security moves from simple instruction files toward layered enforcement architectures.
WHAT HAPPENS NEXT
AI agent security is likely to move toward layered enforcement, combining model instructions with application controls, tool-level guardrails, information-flow restrictions, and operating-system protections.
ActPlane proposes one such approach by converting policies into structured rules that identify sources, operations, effects, timing conditions, and explanations for violations.
The broader direction is becoming clearer:
As AI agents gain greater autonomy, organizations may increasingly treat written instructions as the first layer of control—not the final one.
