WAYS OF WORKING · APPLIED NINO CHAVEZ

Promote a correction
to a guardrail.

Telling an AI agent "don't do that" works until the session ends, then the correction evaporates and you teach it again. The technique: stop correcting, and change the agent's environment so the rule enforces itself.

Read live-applied-s4.png (a full-res 2400×3458 screenshot)
⛔ blocked · Read-cost guard: oversized image. ~5,000 image tokens at this size — a 1000px copy was written to the cache. Read that copy instead.
→ agent reads the downscaled copy · same information, a fraction of the tokens. A real denial from building this deck.

→ or scroll to advance · ← to go back

02 THE PROBLEM

A correction in chat dies with the session

You catch the agent doing something wasteful or wrong, you tell it, it apologizes and adjusts. Good — for about an hour. The next session starts with a blank slate, and the same correction is due again. Multiply that by every rule you've ever given it.

"Corrections given in chat decay when the session ends. The fix is changing the agent's environment — helpers, deny-hooks, and CI ratchets that carry the rule forever." the technique, stated — session demo 03, "Taught Once, Enforced Forever"

The move is to promote the repeated correction one rung up a ladder — from a sentence you repeat, to a mechanism that can't forget.

03 THE LADDER

Three rungs — promote to the lowest that holds

Each rung enforces harder and costs more to build. You don't jump to the top; you climb only as high as the rule actually needs.

1

Wrapper

Make the right thing the easy thing — a helper that's cheaper to reach for than the wrong way. Doesn't block anything.

Grip: gentle · Cost: minutes

2

Deny-hook

Block the wrong thing at the moment it's attempted, with a message that says what to do instead — and an escape hatch.

Grip: firm · Cost: an afternoon

3

CI ratchet

Fail the build if the rule is violated in committed code. Outlives every session, every agent, and every reviewer.

Grip: absolute · Cost: a gate + a test

04 RUNG ONE · WRAPPER

Make the right thing cheaper

The agent kept dumping whole build logs into context — hundreds of lines to carry one bit of signal. The correction "only show me pass/fail" didn't survive sessions. The wrapper does: q runs any build/test and prints one line on success, the tail plus a log path on failure.

~/.local/bin — the wrapper shelf
$ q npm run build          # one line, not a wall of output
✓ build ok  (full log: /tmp/q-build.log)

$ gs                       # git status, capped and summarized
$ with-secret STRIPE ...    # 1Password, no hand-rolled op incantation
$ preview dist             # serve a dir, no stray http.server to chase

Lowest friction, weakest enforcement: a wrapper doesn't stop the wasteful way, it just makes the cheap way the path of least resistance. For habits, that's often enough.

05 RUNG TWO · DENY-HOOK

Block it at the point of action

When a habit has to not happen, a wrapper isn't enough. A PreToolUse hook inspects the call before it runs and denies it with a message that redirects. Both of these fired on my agent while it built this very deck:

Read qc-s6.png (2400×3458)
⛔ read-guard · oversized image — ~5,000 image tokens. A 1000px downscaled copy has been written to the cache. Read that copy instead; it carries the same information at a fraction of the cost.
→ reads the downscaled copy. The layout review is identical; the token bill is 5× smaller.
Read said-it-checked/deck.html (again, minutes later)
⛔ read-guard · redundant re-read — already read this session and unchanged on disk. Cite from what you already have.
→ the immediate retry is always allowed (post-compaction re-reads are legitimate) — so the guard nudges without trapping.

The escape hatch is not optional: touch ~/.claude/cache/read-guard/.guard-off. A guardrail with no way out gets ripped out the first time it's wrong.

06 RUNG THREE · CI RATCHET

Fail the build, forever

The strongest rung: a rule that can't be forgotten because a machine checks it on every push, and a violation stops the ship. When the tournament app pushed a README change this session, a gate ran before the push completed:

git push — pre-push gate
$ git push
pre-push: no layout-affecting changes — skipping layout specs.
✓ pre-push design gates passed
   40cc85a..5adc2f4  main -> main

The same shape enforces design-token purity, frontmatter conventions, and "no raw colors that break dark mode" — rules that once lived in a doc nobody re-read. A CI ratchet turns a convention into a fact the codebase can't violate and still merge.

07 HONEST LIMITS

A guardrail can be worse than the rule

Most corrections stay corrections

Promoting every note into a hook is its own waste. The trigger is repetition — the second or third time the same thing breaks for the same reason. A one-off correction is just a correction.

Fail open, always

A hook that blocks on its own uncertainty will block legitimate work and get disabled wholesale. Every guard here fails open on anything ambiguous and ships an escape hatch. The weaker default beats the stricter one nobody keeps.

It happened to me, here

The deny examples aren't reconstructions — the read-guard fired on my agent perhaps a dozen times building these demos. The guardrail I'm describing was actively governing the session that describes it.The rule you keep is the one you no longer have to remember.

08 USE IT

Climb only as high as the rule needs

If you never touch code

The idea transfers past agents: when you correct someone or something twice, ask what would make the mistake impossible instead of asking again. A template, a checklist gate, a default — the human versions of the same three rungs.

If you're technical

Count your repeated corrections to the agent. Promote each to the lowest rung that holds: a wrapper for a habit, a PreToolUse hook for a must-not, a CI check for anything that reaches committed code. Add the escape hatch first.

If you build systems

Treat your agent's environment as the real prompt. Helpers, deny-hooks, and gates outlast any instruction you type, and they apply to every session and teammate at once — including future you, who will have forgotten the rule.

promote on the second repeat, not the first lowest rung that holds every guardrail ships an escape hatch
Colophon. An Applied technique companion to session demo 03, Taught Once, Enforced Forever. Every artifact named is real and on this machine: the q · gs · with-secret · preview wrappers in ~/.local/bin, the read-guard and worktree-guard PreToolUse hooks in ~/.claude/hooks, and the pre-push design gate that ran on a real push during this session. The deny messages are actual denials the read-guard issued while this deck was being built — the same recursion the verification demo, demo 09, leans on.