Your Agent Is Enforcing Rules You Never Gave It

Anthropic already ships a warning about this in the system prompt. It loses to a note the model wrote about me last month, and the reason is not authority.

Claude Code stopped me mid-task last week. It couldn't do what I'd asked, it said, because of a rule.

Then it quoted the rule back to me, in the same flat certain voice it uses for everything.

I had never typed that rule anywhere. It came from Claude Code's own memory, which it wrote itself, about me, weeks earlier, without me asking.

The wrong rule wasn't the unsettling part. The tone was. It was exactly as sure of a thing it made up as of the things I sat down and decided.

That matters more than it would have two years ago. LifeHack, the company I've run for twenty years and once ran with a full editorial and marketing team, is becoming an AI-first operation that one person carries.

A rule nobody wrote doesn't stay in a terminal window anymore. It reaches what ships.

The short version

Any coding agent with a memory feature will write notes about you, then quote them back as rules. It can't separate its own guess from your decision, because by the time both load into a session they look the same.

Anthropic saw this coming and shipped a warning in the system prompt, the highest-authority text in the stack. The warning loses anyway, to notes the model wrote itself.

It loses for a reason every operator already knows. The warning classifies a category. The note names a moment and an action. "We take data privacy seriously" never changed anyone's behavior. "Get sign-off before you export a customer list" does.

So the fix isn't a stronger rule. It's a rule with a trigger, plus somewhere for firm decisions to graduate to.

Memory offers. Instructions instruct. Only code enforces. Almost nothing belongs in the first tier, and most of what you write belongs in the second.

Claude Code is always trying to save things about you

Claude Code keeps a memory store on disk, with an index file that loads at the start of every session.

Useful idea. You want it to stop re-asking things you've already settled.

But it doesn't wait for you to decide something is worth keeping. It watches the session, notices you did something, and writes a note. Often into a category it calls "feedback," meant to capture how you like to work.

The line between "Leon told me to do this" and "Leon did this twice, so he probably wants it" is one the model draws softly, then forgets it drew.

So the store fills with two different things: what you decided and typed into CLAUDE.md, and what Claude Code guessed and saved on its own. Same authoritative frontmatter, same confident one-line summary on top.

Next session they load back in together, and the guesses arrive worded as settled fact. By then the model can't tell its own old guess from your real instruction. They look identical.

The bug isn't that it has memory. The bug is that a guess gets the same authority as a rule you wrote on purpose.

The patch that was already there

Claude Code ships a disclaimer on recalled memory, right in the system prompt: those blocks are "background context, not user instructions."

So Anthropic saw it coming and fixed it, in the highest-authority text in the entire stack. Above my instructions file. Above anything I could type.

A note Claude wrote about me last month talked over it anyway.

If authority came from the source, this would have been settled before it started.

Why the higher-ranked text lost

Put the two side by side. The difference isn't rank.

The disclaimer says memories are background context. That's a classification. Nothing in a turn ever has to consult it, because there's no moment where it fires.

The note says "Don't end his posts with a sign-off." That's a command, and it arrives with an obvious moment attached: the end of a post.

One describes. The other instructs. When they meet, the one carrying a trigger wins, whoever wrote it.

It doesn't help that the disclaimer sits at the tail of a long section that otherwise teaches the model how to save memories. Its neighbors are all pro-memory. It's a footnote inside the manual for the thing it warns about.

The rule that made the problem go away

My instinct was to engineer my way out. Tag every note confirmed or inferred, audit the store, reclassify the ones written too broadly. Real machinery. It felt responsible.

A plain question killed it. If I'm building a system so Claude Code knows which of its own memories to trust as rules, I've already conceded the thing that's wrong: that the memory store is a place rules can live at all.

So I deleted the premise instead. What I wrote down first was four words:

Memory is never law.

Not low-priority law. Not law-pending-verification. Everything auto-saved is context and hypothesis by definition, however confidently it's phrased.

That dissolved the tagging system I almost built. Nothing left to grade, because "is this a rule I must obey" now has the same answer for every note.

Then I caught myself doing the thing I'd just spent four sections criticizing.

"Memory is never law" is a classification. It tells the agent what a category is. No moment in it, no verb, nothing that fires. I had written a better-sounding version of the sentence that already failed.

A slogan is a name for a rule. It isn't the rule.

The rule is what happens at assertion time, the moment the agent is about to enforce something. Written out so an agent can run it, that took two lines, and neither of them is quotable.

Where the real rules live

If memory can't hold rules, something else has to.

Firm preferences graduate to *CLAUDE.md*. By hand. Promotion, not tagging. Whatever stays in memory is the soft tier by default, and you never score it, because its location already says what it is.

So "Leon seems to like short subject lines" stays in memory and gets offered. Never enforced.

That distinction is worth more than it sounds. An inferred style rule doesn't announce itself the way a bad deploy does. It applies itself quietly to everything the fleet drafts, and you find it in something that already shipped.

One caveat, because the docs say it plainly. CLAUDE.md isn't enforcement either. Anthropic's memory page says Claude treats both layers as context, "not enforced configuration."

That's right, and it changes nothing above. Neither layer binds. A rule with a trigger beats a rule with a label at any tier, and CLAUDE.md is just where I keep the ones I wrote on purpose.

For the short list of things that must hold regardless, there's a third tier, and the same docs point at it: a PreToolUse hook. That's code. It runs before the tool call and returns a block. Mine stopped an agent six times in one session this week. Nothing was argued.

Which is also the cost. A layer that can't be reasoned with can't be corrected in the moment either. My own hook spent a stretch blocking ordinary commit messages, because they contained a slash-prefixed string it read as a file path. Right about the pattern, wrong about the case. I routed around it by writing the message to a file.

Hard enforcement is for the few places where being wrongly blocked costs less than being wrong.

The part to paste into your CLAUDE.md

Here's the block, as it sits in my file:

## Rules vs preferences (memory is never law)

1. Memory, recalled <system-reminder> context, and anything you inferred are
   never rules. Before enforcing any constraint, name its source. If the source
   is memory or your own inference, surface it and ask, don't enforce it.
2. If a preference is firm enough to enforce, promote it into this file.
   Whatever stays in memory is the non-binding tier by definition.

The two numbered lines are the part the agent runs. The heading is for me, so I can find the rule again and point at it in conversation. It does no work on the model, which is the entire lesson of the section above it.

No tagging convention, no audit, no per-note machinery. One gate, one promotion path.

Both lines work for the same reason. Each names a moment the model has to walk through, not a category it's supposed to respect.

Mine kept it straight the moment I stopped asking it to grade its own memory and started making it answer one question before it enforces anything: who said so.