A prompt is not an invariant
A rule you write into an agent prompt or a CLAUDE.md is advisory: the model reads it on every path but only weighs it, and weighing is not refusing, so it holds most of the time, and most of the time is not what a load-bearing rule is for. To make one actually hold it has to move to where compliance is not optional, a check the harness runs and enforces on its own, regardless of what the model decided. With a limit: a gate binds only over the paths it covers, and some rules cannot be settled at any gate at all, because their violation shows up in the world and not in the action it would inspect.