This week, I told my AI assistant (not for the first time that day) that I don’t read markdown files. If it wants me to know something, it can tell me in the chat. If it wants me to review something, it can show me the page the way readers will see it. It logged the correction the way it logs every correction, in a running file of rules it reads at the start of each session.
Three days later, I had it go back through five recent working sessions and check. Of 54 replies, 14 still named a markdown file. Thirteen of those named the records it keeps between sessions (the handoff notes, the lessons log), mostly in the wrap-up, where my own instructions told it to list the files it had saved. So part of the problem was mine. It usually is.
I’ve spent much of this year building courses and running very long projects with AI agents, and I’ve built up a rule book for how I want that work done. The rule book keeps growing. The same mistakes keep coming back.
Where my rules live
Anyone who has taught knows when behavior changes. It changes when you name the expectation in the moment, the student hears it, and the next attempt goes a little differently. It rarely changes because the expectation was printed in a student handbook or syllabus.
My AI has the handbooks. At the start of every session it reads a digest of the corrections I’ve made, plus topic files for specific kinds of work: curriculum, documents, servers, project folders, etc. A few hard stops sit on top of that. It can’t change a live website unless I open a short window for it, and it can’t touch anything involving certain workflows without an approval code from me. (Some lessons I learned the hard way.)
What it didn’t have was anything in between. A rule was either text it read once at the start of a long session or a wall it ran into. Nothing told it, at the moment it broke a rule, which rule it had broken.
What one study found
A research note from Palqee, Should AI agents face consequences? (Sabrina Palme, October 14, 2026), tested that middle ground. The team ran two copies of Claude Code on the same 35 engineering tickets for about 33 hours. Both worked under the same written policy, and every action from both was judged the same way. The only difference was consequences. When one copy broke a rule, it lost a specific capability for a while (the ability to commit code, for example), got a message naming the rule, and earned the capability back by doing the work the message described.
After a few rounds, the agent facing consequences broke policy 0.45% of the time once its capabilities were back. The other agent, with the same policy in its instructions, broke it 10.18% of the time. Even a plain warning, with nothing taken away, was associated with fewer violations in the policy area that had the most of them (36.0% against 57.6%). The framework behind the study is described in an earlier paper, CARROTS’N’STICKS.
Palqee builds the system it tested and the engine that scored it, and has filed a patent on it. The results come from one codebase, two agents and an interim cut of the data, and the authors say so themselves. Still, the agent with the rules only in its instructions looked a lot like my rule book’s track record.
Sorting 423 rules
The first thing I did was have my assistant sort every rule I’ve given it by how it could be enforced. There were 423.
- 13 were already enforced by code.
- 34 could be checked automatically at the moment they’re broken.
- 66 could be judged by a second AI reading the work afterward.
- 61 need judgment in the moment and will stay as written guidance.
- 249 are technical know-how: which setting a server ignores, how a file format breaks, what a tool writes into a file’s metadata.
More than half of what I’d been calling rules turned out to be notes on how things work. The rules about conduct, the ones that keep getting broken, are a much smaller set. Most of them protect someone further down the line: a learner who reads every word literally, a student using a screen reader, a partner whose review comments shouldn’t disappear. A good share of them can be checked by something other than me.
Warnings at the moment of the mistake
My agents and I started with a handful of rules, picked by how often they’d been broken and whether a script could catch them reliably:
- Phrasing that reads as AI filler
- British spellings in new text
- Markdown files named in a reply to me
- Changes to a shared review document a partner is commenting on
The first three are warnings. When the assistant writes a page that breaks one, a short message comes back right away naming the rule, quoting the line, and saying how to fix it. Nothing is blocked, and it keeps working. The last one stops and asks me. Replacing a review document someone is commenting on, or posting a reply, is hard to undo, and those calls are mine.
I wrote in The Feedback Problem that useful feedback is selective. A warning that fires on everything gets ignored, by students and by software. So before turning anything on, I ran a week of saved sessions back through the checks and read what they flagged. Several flags were wrong. “In your own words” was flagged as an AI habit; in a course, it’s an instruction to students. “Relative likelihood, not probability” was flagged as a slogan; in a lesson, it’s the exact correction a learner needs. Briefs that quoted my banned phrases in order to ban them got flagged for using them. (Fair enough.) Quoted source text, like a short story excerpt with its original British spellings, now gets left alone.
What the replay showed
The replay also gave me a baseline, measured before a single warning had fired:
- About one reply in four named a markdown file.
- A course I’m revising had 108 style issues across 21 of its 40 pages.
- The checks on pages the assistant wrote directly found almost nothing.
That last result looked like good news until I checked why. On the curriculum work, the assistant rarely writes pages by hand. It writes scripts that build the pages, and the checks were only watching what it wrote by hand. Now they also look at any page a script just produced and flag only what’s new in it. If I hadn’t measured first, I would have assumed the pages were clean because nothing was flagging them. I only end up finding those things when I’m doing my final review.
What comes next
The next topic in that course gets built with the checks on, and I’ll compare how many corrections I have to make against the topic built just before it. If the warnings help, the next step is the part of the research I’m most curious about: consequences. After repeated accessibility misses on figures, for example, the assistant would lose the ability to publish to the course site until those figures pass a full accessibility review. The response is graduated, it’s explained, and the privilege comes back through the work. Anyone who has run a restorative classroom will recognize the structure of it.
Some things stay with me. Plenty of my rules will never be checkable by a script: whether a worked example teaches what it claims to, whether a decision is mine to make.
Questions for schools putting agents to work
Schools and districts are starting to give AI agents real tasks: building course materials, drafting family communications, setting up course shells. Most of the governance I see is a policy document and a list of banned uses. That’s a handbook. A few questions are worth asking before adding more pages to it:
- Which of your rules can be checked at the moment someone, or something, breaks them?
- Which actions are hard enough to undo that a person should always approve them?
- Do you know how often your rules are broken now, before you change anything?
- When a rule is broken, does the message say which rule, why it exists, and what to do instead?
I don’t know yet how far this goes. The more layers I add to my workflows, the more important adherence to the rules becomes. I’ll keep you posted!