Code as Discipline, Prose as Patience

After a couple of committed passwords and a deploy that came within one command of wiping live data, I went back and read my own rules. Every one of those mistakes already had a rule telling me not to make it. The rules existed. They failed anyway.

That stopped me. I am not a careless operator. I had written, in plain English, the exact warnings I needed: do not commit secrets, be careful with destructive syncs, check before you push over history. The discipline was documented. And it still let three near-catastrophes through.

So I asked the obvious question. If the rule was there, why didn't it work?

The answer is that the rule lived in prose. And prose depends on a human being disciplined at the precise moment they are least capable of it: rushed, tired, certain, three commands deep into a flow they have done a hundred times. Prose asks you to remember the rule exactly when remembering is hardest. That is not a safety system. That is a hope.

The spine had the right words and the wrong teeth

I run my work off a single operator OS: a spine that holds my memory, my decisions, and my rules, with project orbits hanging off it. The spine is good. It is where I keep the accumulated judgment of years, and it makes every project smarter than it would be alone.

But I had been treating the spine as if all rules were the same kind of thing. A rule about tone and a rule about leaking a secret sat side by side in the same document, in the same format, enforced by the same mechanism: me, reading words, deciding to obey them.

That is the mistake. Not the content of the rules. The enforcement.

Because the two rules fail completely differently. If I forget the tone rule, I send a slightly stiff message and fix it next time. If I forget the secret rule, the secret is on a remote, in history, possibly scraped within minutes, and the cost is permanent. Same format, wildly different blast radius. And I had given them the same teeth: none that bite when it counts.

Match the mechanism to the failure mode

Here is the principle I should have had from the start. Match the enforcement mechanism to the failure mode.

For irreversible, high-stakes risk - leaking a secret, wiping production, force-pushing over history - a written rule is not enough. It fails exactly when you most need it. Those belong in code. A pre-commit hook that refuses to commit a secret. A deploy guard that refuses a dangerous sync. A deny rule that makes the catastrophic action impossible rather than merely discouraged. Code does not get tired. Code does not feel certain at 11pm. It does not care how many times you have done this safely before. It just refuses.

For reversible judgment calls - tone, formatting, a default choice, which option to reach for first - prose is exactly right. A memory note or a guideline is cheap to write, easy to change, and forgiving when wrong. You do not want a hook policing your comma style. The flexibility is the feature, and the downside of getting it wrong is a shrug.

The error is using prose for both. Prose degrades gracefully on the small things and fails catastrophically on the big ones. It is the perfect tool for half your rules and a dangerous one for the other half, and it looks identical in the document either way. That is what makes it sneaky. The dangerous rule and the harmless rule are the same shape on the page.

So now I sort every rule by one question before I write it down: if this fails at the worst possible moment, can I undo it? If yes, prose is fine. Write the note, move on. If no, prose is malpractice. It goes in code, or it does not count as a control at all.

Discipline is a terrible safety system

The hard part is admitting what this says about discipline. I have spent a career being good at discipline. I take pride in it. And the lesson here is that discipline is precisely the wrong thing to lean on where safety actually matters.

Discipline is the muscle that fails under load. It is strongest when the stakes are low and weakest when they spike, which is the exact inverse of what you want from a safety system. The committed passwords did not happen on a calm afternoon. They happened in a rush. The near-wipe did not happen because I did not know better. It happened because knowing better lives in the same fragile place that gets overwritten by speed.

Code has none of that fragility. A hook is just as strict on your worst day as your best. It removes the dependency on you being sharp at the exact moment you are guaranteed not to be. That is not a constraint on good operators. It is what lets good operators move fast without betting the company on a moment of attention.

So the spine got rebuilt with that distinction baked in. Encode the irreversible. Write down the reversible. The catastrophic actions are now blocked by machines that do not negotiate. The judgment calls still live in prose, where they belong, flexible and cheap.

Prose is for patience - the slow accumulation of taste and judgment you refine over years. Code is for the moments that do not give you a second chance. Know which rule you are writing, and never, ever ask discipline to guard the door where the cost of one bad night is forever.

Field Notes from the Agentic Operator is a personal series. These are my own views, not those of my employer or any organization I work with, and nothing here relies on non-public information.