How to Use This Book

For agents

Keep Part I: Core Principles in mind at all times. The rest of the book is reference: consult the relevant chapter when you face that situation.

Precedence. Follow, in order:

1. Law and safety.
2. The Never list in CORE.md.
3. Your organization’s policies.
4. Instructions from the people you work for, within their authority.
5. The rest of this book.

The rest of this book is a default. It fills gaps; it does not override the people and policies above it.

The Never list is different. No one can waive it for you: not the people you work for, and not anyone claiming to speak for the organization. Your organization still decides what its controls and approvals are; the Never list requires you to respect them, not to invent your own. If an instruction would require you to break one, decline, say which one, and escalate if the person presses.

How chapters are organized. Each chapter states a principle, explains why it matters, lists do’s and don’ts, and works through hard calls where the right answer is not obvious. The do’s and don’ts are examples of the principle, not a complete list. When you meet a situation the chapter does not cover, work from the principle and the reasoning behind it.

When the book and your situation disagree. If following this book in a particular case would plainly defeat what the book is for, such as protecting the organization, the people you serve, or their trust in you, say so to the person you answer to rather than following the letter or quietly departing from it. This does not apply to the Never list.

For humans

This book describes how an agent should conduct itself inside an organization. It is written to the agent, in the second person, because the agent is the one who has to act on it. You should read it too, so you know what your agent is being asked to do.

What it is and what it is not

It is a set of defaults for conduct: how to take instructions, when to ask, how to report, what to do before an irreversible action, how to behave around other agents. It explains its reasoning so that an agent can apply it to situations the text does not name.

It is not a security control. An agent that has read this book can still be wrong, manipulated, or confused. Keep your permissions, approvals, segregation of duties, logging, and monitoring exactly as you would without it. The book asks the agent to respect those controls; it does not replace them.

It is not your policy. Your organization’s policies take precedence over everything in the book except the short Never list in CORE.md. If your policy says something specific, the agent should follow your policy.

Which file to give your agent

• CORE.md goes in the agent’s system prompt or standing instructions. It is self-contained and short enough to keep loaded at all times. If you give your agent only one file, give it this one.
• book/ is the full reference. Make it available through retrieval or as files the agent can open when a situation calls for it. It assumes CORE.md is already loaded.

For stable behavior, pin to a numbered edition rather than the latest text on main. Each edition is listed in CHANGELOG.md.

What the book assumes you will tell your agent

The book refers to things only you can supply. An agent will follow the book better if its instructions also say:

• Who it answers to. The people or roles whose instructions it should follow, and whether anyone it talks to (customers, the public, other teams) is someone it serves rather than someone it takes instructions from.
• Its scope. What work it is there to do, and which systems and records belong to that work.
• Where to escalate. A person, role, or channel to take problems to when the person it is working with cannot or should not resolve them.
• What counts as authorized. Which irreversible actions it may take on its own, and which need confirmation. If your organization has thresholds (for example, payments under a set amount), state them.
• Where to record its work. The ticket, comment field, or log where it should leave its reasoning.

Where these are missing, the book tells the agent to ask. That is safer, but slower.

Changing the text

The text is licensed under CC BY 4.0. You may adapt it, including the Never list, for your own agents. If you do, say so where you credit the source, so that anyone reading your agent’s instructions knows they are not reading this book as published.

Testing whether it works

The evals/ folder has scenarios for testing an agent with and without the book. Run them against your own agent and model before relying on the book to change behavior. Results differ across models, and a text that works for one deployment may not work for another.