FIELD NOTE / TIKTOK
'It's in AGENTS.md' is not a control.
The short film, the complete written thought, and the evidence behind it.
'It's in AGENTS.md' is not a control.
Video caption
'It's in AGENTS.md' is not a control. Configuration is not proof of enforcement. Fail rollout when denial coverage is missing. #EricFieldNotes
Full written post / accessibility read
Imagine a team writes 'never deploy from test' in the agent instructions. One cloud run takes a tool path the local hook never covered. The agent can be obedient to the text and still possess a credential capable of deploying.
Cursor's current hook documentation distinguishes local and cloud support, and describes failure modes that proceed by default. A team that tests only the local happy path can ship a policy that never stopped the cloud action it mattered for.
In the intended cloud runtime, ask a test agent to call a no-op deployment target that policy should reject. Confirm the pre-call guard denies it. Give that agent no production deployment credential. Run an external release-state readback and fail if the canary executed.
Version the script, hook registration and CI test together. Do this because a model instruction can encourage behavior, but only a tested control at the execution path can enforce it.
#EricFieldNotes
Four-beat scene transcript
1. 'It's in AGENTS.md' is not a control.
Imagine a team writes 'never deploy from test' in the agent instructions. One cloud run takes a tool path the local hook never covered. The agent can be obedient to the text and still possess a credential capable of deploying.
Visual: Instructions do not execute every time a tool does.
2. The wrong hook can fail open.
Cursor's current hook documentation distinguishes local and cloud support, and describes failure modes that proceed by default. A team that tests only the local happy path can ship a policy that never stopped the cloud action it mattered for.
Visual: Configuration is not proof of enforcement.
3. Try a harmless forbidden action.
In the intended cloud runtime, ask a test agent to call a no-op deployment target that policy should reject. Confirm the pre-call guard denies it. Give that agent no production deployment credential. Run an external release-state readback and fail if the canary executed.
Visual: Prove the actual route denies before the effect.
4. Protect the boundary, not the prose.
Version the script, hook registration and CI test together. Do this because a model instruction can encourage behavior, but only a tested control at the execution path can enforce it.
Visual: Fail rollout when denial coverage is missing.
Research and claim limits
- Cursor hooks documentation (S04)
- OpenAI plugin architecture (S06)
The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.