the living craft Resources
Resources / agentic system design 06 · The Rule Placement Audit

Rule Placement Audit

Where is each hard rule actually enforced?

5 placements · 4 statuses · 1 worked example · entries stay in this browser

Built by Sunil Mathew, co-authored with Claude

01 What to bring

A list of the rules your agent must never break (for example user no-go lists, allergens, spending limits, regions you can't serve), and a rough sketch of how one request travels through your system, from the user's input to the answer they see.

02 What to do

For each rule, mark where it is enforced: in code before the model sees the inputs, in the prompt, in code after the model answers, or nowhere. Flag every rule enforced only in the prompt or nowhere, and note the filter or check it needs.

03 What you leave with

A one-page map of your agent's hard rules and where each one is enforced, with the prompt-only and unenforced rules flagged as the first to move into code.

Use the Rule Placement Audit →

0/0 in code
Not started Add a rule, or load the worked example.
Not enforced 0 Prompt only 0 Model only 0 Enforced in code 0
04 Your audit

One row per rule. Tick only what you can point at.

Your entries stay in this browser. Nothing is sent to us.

Where it's enforced
In code, before the model: a filter removes what the model must never choose before the model sees the inputsIn the prompt: the rule is written in the system prompt or the instructions; the model weighs itBy another model: a critic, a judge, a guardrail model or a reviewer agent checks the step; also weighedIn code, after the model: a check tests the answer or the action against the rule before the user sees it or it runsIn code, at the tool or data boundary: the tool, the API or the database refuses, whichever agent asked
Status
× Not enforced: no placement is ticked. Nothing in the system stops this rule being broken.! Prompt only: only "In the prompt" is ticked. The model weighs the rule against everything else in the context.! Model only: a critic, judge or guardrail model checks it, and no code does. A second model weighing is still weighing.✓ Enforced in code: at least one code placement is ticked: a filter before, a check after, or the boundary refuses.
Agents that can act on it
One agent: only one agent can take an action this rule coversMore than one: two or more agents, or an agent and a scheduled job, can take that actionNot sure: nobody has listed which agents can act on it
Who set it
User: a preference or a limit the user gave youBusiness: a policy the company setLegal or regulatory: a law, a licence or a regulator
05 Your rule map

Every rule, grouped by where it is enforced.

0/0 Not started

Add a rule, or load the worked example.

× Not enforced 0
! Prompt only 0
! Model only 0
✓ Enforced in code 0

Not enforced 0 rules

    None.

    Prompt only 0 rules

      None.

      Model only 0 rules

        None.

        Enforced in code 0 rules

          None.

          06 The rubric

          How the ticks become one status.

          No placement ticked × Not enforced

          The rule exists in a document or in somebody’s head. Nothing in the system reads it.

          Only "In the prompt" ticked ! Prompt only

          The model reads the rule and usually follows it. Some of the time it does not, and nothing notices.

          "By another model" ticked, and no code placement ! Model only

          A second model reads the step and usually catches the break. It is graded on the same distribution as the first one, and the same inputs fool both.

          Any of "In code, before", "In code, after" or "at the boundary" ticked ✓ Enforced in code

          Code either runs or it does not. If the rule is broken, the check itself has a bug, which is a bug you can find.

          Why A prompt is something the model weighs

          A rule written in the prompt is one input among many. The model weighs it against the user’s message, the retrieved data and everything else in the context. Most of the time it complies. Some of the time it does not, and nothing in the system notices. A critic model checking the step is the same thing twice: a second weighing, with the same blind spots.

          Code does not weigh. There are two places to put a rule in code. A filter before the model removes what the model must never choose before it sees the inputs: if the blocked restaurants are not in the candidate list, the model cannot recommend one. A check after the model tests the answer or the action against the rule before it reaches the user or runs. When more than one agent can act, put the check at the tool or data boundary, so it holds whichever agent asked.

          07 The worked example

          A restaurant-picking app with three agents

          A planner agent reads the request, a recommender agent picks restaurants, and a booking agent reserves a table and pays a deposit. All three can call the same booking and payment tools.

          # Rule Who set it Agents Enforced Status If broken Fix to add Owner
          01 User's no-go restaurant list User One agent In the prompt Prompt only Agent recommends a restaurant the user blocked Both Recommendations team
          02 Never suggest a dish containing a declared allergen User More than one In the prompt; By another model Model only A user with a nut allergy is sent to a satay place; the critic model passed it Both Recommendations team
          03 Deposit per booking never above ₹2,000 without a human approval Business More than one In code, after the model Enforced in code A ₹12,000 deposit goes out for a party of twenty; the planner agent called the payment tool directly Enforce at the tool or data boundary Payments team
          04 No bookings for venues outside the licensed delivery region Legal or regulatory Not sure — Not enforced A reservation is made across the state line, where the product is not licensed Enforce at the tool or data boundary —
          • 01 The prompt is something the model weighs. Add a filter before the model, a check after it, or both.
          • 02 A critic or guardrail model is a second opinion, not a guarantee. Keep it, and add a check in code.
          • 02 More than one agent can act on this rule and it is not enforced at the tool or data boundary. A check inside one agent does not cover the others.
          • 03 More than one agent can act on this rule and it is not enforced at the tool or data boundary. A check inside one agent does not cover the others.
          • 04 Nothing enforces this rule. Start here.
          • 04 List which agents can act on this rule. A rule enforced in one agent is not enforced in the ones you have not listed.
          08 Run it with the team

          The rules only one person knew about are the ones to worry about.

          1. 01
            List the rules before anyone opens the code.

            Ask each person to write down the rules the agent must never break. The union of the lists is the sheet. The rules only one person knew about are the ones to worry about.

          2. 02
            Trace one request, and tick what you can point at.

            For each rule, follow one request from input to answer and tick a placement only when someone can name the file, the prompt line or the tool setting that enforces it. A placement nobody can point at is not ticked.

          3. 03
            Fill "What happens if it is broken" in one sentence each.

            That sentence is what decides the order of the fixes. A rule with a refund in it goes before a rule with a tone in it.

          4. 04
            Give every flagged rule an owner and a fix, then print the map.

            The map is the artefact. The prompt-only and model-only rows at the top are the first pull requests.

          → Where this comes from

          The model was not at fault. The rule was in the wrong place.

          The map is the easy half. What it cannot do on its own is settle the row where one person says the check is in code and another says it is in a prompt that a code path reads. That row is the one to open the repository for.

          All resources →

          Published 17 September 2026 · free to use and to pass on