Give an agent broad tools and a vague goal.

Video caption

Give an agent broad tools and a vague goal. Covered hooks, effect limits and release proof. The boundary must outlive one session. #EricFieldNotes

Full written post / accessibility read

In a fictional team, an agent can edit code, tests and release settings. The instruction says 'make enterprise access work.' It ships a neat feature and updates tests to match. The original migration-only tenant rule was outside its shortened brief. More prompting will not restore an authority it never saw.

A pre-tool Python script parses and denies forbidden operations on covered file calls. Arbitrary shell and MCP routes are denied or run with OS and network permissions that cannot reach the protected fixture or release service. A post-action script records actual changes. Trusted CI tests the exact artifact against the original customer decision.

In a disposable repo, request the same forbidden effect through file, shell and MCP calls. Malformed permission-hook JSON with exit zero should block under Cursor's current docs; unexpected nonzero exit may proceed. In both cases inspect real state, then verify that lower permissions block the effect and protected CI rejects a deliberately wrong patch.

The rule: script policy for the tool routes you actually intercept, deny or sandbox everything opaque, and keep an independent acceptance gate for what may ship. Do this because markdown rules can be ignored and even a correctly firing hook cannot constrain an unobserved program or service call.

#EricFieldNotes

Four-beat scene transcript

1. Give an agent broad tools and a vague goal.

In a fictional team, an agent can edit code, tests and release settings. The instruction says 'make enterprise access work.' It ships a neat feature and updates tests to match. The original migration-only tenant rule was outside its shortened brief. More prompting will not restore an authority it never saw.

Visual: You may get a confident wrong release.

2. Put three boundaries in place.

A pre-tool Python script parses and denies forbidden operations on covered file calls. Arbitrary shell and MCP routes are denied or run with OS and network permissions that cannot reach the protected fixture or release service. A post-action script records actual changes. Trusted CI tests the exact artifact against the original customer decision.

Visual: Covered hooks, effect limits and release proof.

3. Try to bypass your own harness.

In a disposable repo, request the same forbidden effect through file, shell and MCP calls. Malformed permission-hook JSON with exit zero should block under Cursor's current docs; unexpected nonzero exit may proceed. In both cases inspect real state, then verify that lower permissions block the effect and protected CI rejects a deliberately wrong patch.

Visual: Bad output and alternate tools matter.

4. Keep creativity inside a hard box.

The rule: script policy for the tool routes you actually intercept, deny or sandbox everything opaque, and keep an independent acceptance gate for what may ship. Do this because markdown rules can be ignored and even a correctly firing hook cannot constrain an unobserved program or service call.

Visual: The boundary must outlive one session.

Research and claim limits

• Cursor hooks documentation (S04)
• GitHub Docs: ruleset required status checks (S146)

The examples identified as illustrative or simulated are design probes, not reported incidents. Vendor specifications do not establish workload performance.