AI Agent Instruction File Governance Checklist

Brand: OperatorForge AI

Updated: 2026-06-08

Format: free checklist + instruction register + conflict audit template

Use when: a founder, engineering lead, automation consultant, or ops owner has started adding AGENTS.md, CLAUDE.md, Cursor rules, Codex instructions, MCP server notes, hooks, or reusable agent prompts and needs them to be safe, current, non-conflicting, and reviewable.

Why this matters now

The 2026-06-08 scan found a fresh cluster around agent instruction files becoming operational infrastructure:

Hacker News surfaced “Show HN: Evolution of my AGENTS.md”, a direct signal that teams are iterating on persistent agent instruction files.
GitHub search showed fresh movement around Claude Code hooks/plugin trackers, agent permissions, OPA-style policy guardrails, agent hygiene reports, and agent audit tooling.
The buyer pain is shifting from “what should my agent do?” to “which standing instructions is it obeying, who approved them, and what happens when two instructions conflict?”

The monetizable gap: most teams will accumulate agent rules the way they accumulated wiki pages — organically, inconsistently, and with stale exceptions. A compact governance pass can prevent unsafe authority expansion, secret leakage, brittle instructions, and accidental policy bypass.

10-minute instruction-file readiness pass

Gate	Pass condition	Evidence to keep
Inventory	Every persistent agent instruction file and hook is listed	instruction register
Ownership	Each instruction set has a human owner and review date	owner field
Scope	Rules name the workspace, tools, allowed actions, and forbidden actions	scope block
Conflict check	Similar files do not disagree on write, deploy, spend, or delete behavior	conflict log
Secret boundary	Instructions do not contain raw keys, passwords, customer secrets, or private tokens	secret scan note
Authority boundary	Rules cannot silently expand agent rights beyond the approved tool policy	permission matrix
Evidence rule	Agent completion instructions require real verification output	evidence standard
Change control	Edits to instruction files are reviewed like product/config changes	review record

Minimum instruction register

Field	Required?	Notes
`instruction_id`	yes	Stable name such as `repo-agents-md` or `claude-hooks-policy`
`file_or_source`	yes	Path, URL, prompt-pack source, or tool config
`human_owner`	yes	Accountable reviewer
`agent_scope`	yes	Which agent/client reads it: Claude Code, Codex, Cursor, MCP server, n8n workflow, etc.
`allowed_tools`	yes	Explicit tool set or inherited policy reference
`forbidden_actions`	yes	Deletes, deploys, credentials, money movement, customer messages, broad filesystem access
`evidence_required`	yes	Tests, screenshots, logs, diffs, browser checks, audit rows
`last_reviewed`	yes	Date and reviewer
`conflicts`	yes	Known conflicts or “none found”
`rollback_step`	yes	How to restore a prior instruction version

Checklist

1. Inventory all standing instructions

☐ Locate AGENTS.md, CLAUDE.md, .cursorrules, rules/, hooks, slash commands, MCP server prompts, workflow-agent system prompts, and reusable prompt packs.
☐ Record which tools or agents load each file automatically.
☐ Flag instructions copied from the internet, generated by an agent, or inherited from a template.
☐ Mark anything that can trigger commands, edit files, access browsers, call APIs, or read credentials.

2. Put ownership and review cadence on every file

☐ Add a top-of-file owner, purpose, scope, and last-reviewed date.
☐ Require review before instructions are used in production/client work.
☐ Set a 30- to 90-day review cadence for high-authority rules.
☐ Archive old experiments instead of leaving them in active load paths.

3. Separate guidance from authority

☐ Split tone/style guidance from operational permissions.
☐ Do not let a prompt file grant new tools, secrets, deploy rights, or spending authority by itself.
☐ Reference the approved permission matrix instead of duplicating permissions in five places.
☐ Put high-risk actions behind human approval even if the instruction file says the agent is “autonomous.”

4. Run the conflict audit

☐ Compare every instruction file that touches write, deploy, delete, send, spend, credential, or customer-data behavior.
☐ Flag contradictions such as “never deploy” versus “deploy when tests pass.”
☐ Flag stale product names, old URLs, old package managers, old run commands, and retired APIs.
☐ Flag vague success criteria such as “verify it works” without naming tests or evidence.

5. Add evidence-first completion rules

☐ Require command output, screenshots, diffs, HTTP checks, browser checks, or log excerpts for claimed completion.
☐ Require blockers to be reported plainly instead of hidden behind “mostly done.”
☐ Require public/live verification for deployed assets, not only local file checks.
☐ Require content-type/body-marker checks for URLs that can return fallback HTML with HTTP 200.

6. Protect secrets and customer data

☐ Remove raw tokens, passwords, private URLs, customer records, and credential hints from instructions.
☐ Replace secrets with environment-variable names and least-privilege setup notes.
☐ Add a rule that tool output can be untrusted and must not be pasted into privileged prompts without review.
☐ Add a redaction rule for logs and client handoff packets.

7. Version and rollback instruction changes

☐ Commit or archive every active instruction file before editing.
☐ Keep a short changelog of why each rule changed.
☐ Tie major instruction changes to a ticket, run ID, or review note.
☐ Test one rollback from the current instruction set to the previous known-good version.

Copy-paste instruction register template

Instruction ID:
File/source:
Loaded by:
Human owner:
Business purpose:
Allowed tools/actions:
Forbidden actions:
Evidence required for completion:
Secret/data handling rule:
Known conflicts:
Last reviewed:
Rollback step:
Decision: active / revise / archive / quarantine

Consultant packaging angle

Sell this as a fast cleanup for teams that have started using coding agents or MCP-enabled assistants:

$250-$500 agent-instruction audit: inventory instruction files, identify conflicts, remove stale commands/secrets, and write the register.
$750-$1,500 instruction-governance sprint: build a permission matrix, evidence standard, owner cadence, rollback policy, and approved template.
$1,500-$3,000 agent operating-system hardening: combine instruction governance with MCP security, agent work verification, observability, rollback ledgers, and skill/tool-bundle review.

Acceptance criteria

Before persistent agent instructions are trusted for client or production work:

☐ Every loaded instruction file is inventoried.
☐ Every high-authority instruction has an owner and review date.
☐ Tool permissions live in a permission matrix, not a stray prompt.
☐ Conflicts are resolved or explicitly documented.
☐ Secret/customer-data boundaries are written and scanned.
☐ Completion requires real evidence, not an agent summary.
☐ Instruction changes are versioned and reversible.

CTA

Need the broader implementation pack? The OperatorForge AI Pro Pack includes practical automation checklists, prompt packs, and client handoff templates for small-business AI automation work.

Govern the instructions before agents obey the wrong ones.