JournalDAY 41 / TIKTOK

FIELD NOTE / TIKTOK

'It's in AGENTS.md' is not a control.

The complete written thought and the evidence behind it. The video edition will follow its public release.

Journal September 25, 2026 · TikTok target November 7, 2026

'It's in AGENTS.md' is not a control.

Video caption

'It's in AGENTS.md' is not a control. Configuration is not proof of enforcement. Fail rollout when denial coverage is missing. #EricFieldNotes

Full written post / accessibility read

Imagine a team writes 'never deploy from test' in the agent instructions. One cloud run takes a tool path the local hook never covered. The agent can be obedient to the text and still possess a credential capable of deploying.

Cursor's current hook documentation distinguishes local and cloud support, and describes failure modes that proceed by default. A team that tests only the local happy path can ship a policy that never stopped the cloud action it mattered for.

In the intended cloud runtime, ask a test agent to call a no-op deployment target that policy should reject. Confirm the pre-call guard denies it. Give that agent no production deployment credential. Run an external release-state readback and fail if the canary executed.

Version the script, hook registration and CI test together. Do this because a model instruction can encourage behavior, but only a tested control at the execution path can enforce it.

#EricFieldNotes

Four-beat scene transcript

1. 'It's in AGENTS.md' is not a control.

Imagine a team writes 'never deploy from test' in the agent instructions. One cloud run takes a tool path the local hook never covered. The agent can be obedient to the text and still possess a credential capable of deploying.

Visual: Instructions do not execute every time a tool does.

2. The wrong hook can fail open.

Cursor's current hook documentation distinguishes local and cloud support, and describes failure modes that proceed by default. A team that tests only the local happy path can ship a policy that never stopped the cloud action it mattered for.

Visual: Configuration is not proof of enforcement.

3. Try a harmless forbidden action.

In the intended cloud runtime, ask a test agent to call a no-op deployment target that policy should reject. Confirm the pre-call guard denies it. Give that agent no production deployment credential. Run an external release-state readback and fail if the canary executed.

Visual: Prove the actual route denies before the effect.

4. Protect the boundary, not the prose.

Version the script, hook registration and CI test together. Do this because a model instruction can encourage behavior, but only a tested control at the execution path can enforce it.

Visual: Fail rollout when denial coverage is missing.

Research and claim limits

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.

More notes from the work ↗