FIELD NOTE / TIKTOK
'It's in AGENTS.md' is not a control.
The complete written thought and the evidence behind it. The video edition will follow its public release.
The written argument is here.
This approved TikTok edition is on the journal now. Its video player and original platform link will appear after each public release is verified.
'It's in AGENTS.md' is not a control.
Video caption
'It's in AGENTS.md' is not a control. Configuration is not proof of enforcement. Fail rollout when denial coverage is missing. #EricFieldNotes
Full written post / accessibility read
Imagine a team writes 'never deploy from test' in the agent instructions. One cloud run takes a tool path the local hook never covered. The agent can be obedient to the text and still possess a credential capable of deploying.
Cursor's current hook documentation distinguishes local and cloud support, and describes failure modes that proceed by default. A team that tests only the local happy path can ship a policy that never stopped the cloud action it mattered for.
In the intended cloud runtime, ask a test agent to call a no-op deployment target that policy should reject. Confirm the pre-call guard denies it. Give that agent no production deployment credential. Run an external release-state readback and fail if the canary executed.
Version the script, hook registration and CI test together. Do this because a model instruction can encourage behavior, but only a tested control at the execution path can enforce it.
#EricFieldNotes
Four-beat scene transcript
1. 'It's in AGENTS.md' is not a control.
Imagine a team writes 'never deploy from test' in the agent instructions. One cloud run takes a tool path the local hook never covered. The agent can be obedient to the text and still possess a credential capable of deploying.
Visual: Instructions do not execute every time a tool does.
2. The wrong hook can fail open.
Cursor's current hook documentation distinguishes local and cloud support, and describes failure modes that proceed by default. A team that tests only the local happy path can ship a policy that never stopped the cloud action it mattered for.
Visual: Configuration is not proof of enforcement.
3. Try a harmless forbidden action.
In the intended cloud runtime, ask a test agent to call a no-op deployment target that policy should reject. Confirm the pre-call guard denies it. Give that agent no production deployment credential. Run an external release-state readback and fail if the canary executed.
Visual: Prove the actual route denies before the effect.
4. Protect the boundary, not the prose.
Version the script, hook registration and CI test together. Do this because a model instruction can encourage behavior, but only a tested control at the execution path can enforce it.
Visual: Fail rollout when denial coverage is missing.
Research and claim limits
- Cursor hooks documentation (S04)
- OpenAI plugin architecture (S06)
The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.