Locks, not willpower

Think of it when you give the same warning a second time, or a rule depends on people never forgetting it.

In everyday life

Like a microwave that will not start while its door is open. Nobody has to remember the rule. It stops only that one danger, though; a metal fork inside still needs care.

One case

A team’s rule says “never commit passwords”, and every new developer hears it on day one. In February and again in March, a developer commits a password anyway, and each one sits in a public repo for hours. In April the team adds a secret scannerA tool that searches a change for text that looks like a password or key, and blocks the commit when it finds one. that blocks any commit with a password it recognizes. From April to June, no password reaches the repo.

Two leaks with the rule alone, none after the check
The case, cell by cell1 cell = 1 month
Passwords that should be committed
000000
Passwords committed
011000
Leaks with the rule alone
2
Leaks after the check
0
The scanner went in at the start of April. The two leaked passwords still had to be replaced.

Every case

People forget, get tired and are new. AI agents can lose instructions in a long session. A rule that lives in words fails at the moment someone is not reading it. A rule built into the tools, such as a test, a type, a lintA tool that reads code and flags patterns you have banned, before the code runs., a script that blocks a step, or a permission that is never granted, works without anyone remembering it. A check blocks only what it recognizes: a scanner knows common password and key patterns and can miss others. So also limit who can reach real secrets, and replace any key that was exposed, because someone may already have copied it.

The word

Engineers call this

guardrailsA check built into the tools that blocks a known mistake, instead of a rule that people must remember. It works without willpower, but only on the mistakes it can recognize.

Turn a repeated warning into a check that blocks the mistake. Keep words for what a check cannot catch.

Where this idea leads

Skills that encode it

  • principle-encode-lessons-in-structure pstackWhen you write the same instruction a second time, encode it as a lint, runtime check or script instead of more text.
  • correct pstackFix a repeated mistake at the highest level that works. Docs and agent rules come last, only for judgment calls.