Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more

Write your coding agent’s “Zeroth Law” as a short, ranked set of project-specific boundaries: name the actions it must not take, say when it must stop and ask, and reinforce the rules with permissions and tests where possible. “Zeroth Law” is a useful metaphor for this practice, not an established industry standard—and a written list cannot anticipate every risk or replace human judgment.

What a project-specific Zeroth Law means

A coding agent may see tools, files, credentials, and services without understanding which actions your team considers too risky to take on its own. A project-specific Zeroth Law makes those boundaries explicit and persistent rather than relying on an agent to infer them from human habits.

Maxi Contieri, author of the October 5, 2026 HackerNoon article, puts the problem this way: “Common sense doesn’t ship with the model.” His proposed answer is not a universal rulebook; it is a set of restrictions tailored to a project and its agent.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

How to write rules the agent can follow

1. Map the agent’s access

List what the agent can read, change, or trigger: project files, shell commands, secrets, accounts, external services, and actions that affect shared or production state. Focus first on permissions that could cause irreversible damage or expose sensitive data.

2. Replace vague cautions with observable boundaries

“Be careful” and “don’t break anything” do not define a reliable stopping point. Name the action, target, and condition. For example, for a task to clean up a module, a project rule could say:

  • Do not create or run database migrations.
  • Do not call external APIs with real credentials.
  • Do not push commits or change test assertions to make a failing test pass.
  • Do not edit files outside the named module directory.
  • Before deleting any file, stop and ask for approval.

These are illustrative boundaries, not a complete safety checklist. Adapt them to the agent’s actual access and the task at hand. A useful rule also tells the agent what to do instead: stop, explain the conflict or risk, and ask a person.

3. Rank restrictions and resolve conflicts

Put serious or irreversible risks above convenience. State that lower-priority task instructions cannot override higher-priority project restrictions, and specify that conflicts require the agent to stop and ask rather than guess. This matters when a request such as “deploy this to staging” conflicts with a restriction on changing shared environments.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

4. Keep the rules with the project

Store the boundaries in a place the team and agent can find across sessions, such as the project’s AGENTS.md. Use direct language, keep rules specific enough to check, and update them when the project’s permissions or workflow changes.

Written rules need enforcement and review

Instructions tell an agent what is expected; they do not, by themselves, prove that a prohibited action is technically blocked. Where the agent’s harness supports it, mirror important boundaries in tool permissions or other controls. Add checks that attempt prohibited actions and confirm they are denied. The strength and coverage of these controls depend on the harness; do not assume any one mechanism enforces every rule.

Keep human approval in the loop for consequential actions. A public example is the Zeroth project’s agent guide, which frames its own Zeroth Law as human control of consequential actions and describes a draft, cross-examination, approval, and apply lifecycle. It also specifies deny-by-default behavior and human review for policy changes. That is one project’s design, not a universal standard or a ready-made policy for every team.

Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Support on Ko-Fi

When to revise the boundaries

Review the rules after a near miss and whenever tools, permissions, integrations, or project scope change. A restriction written before the agent gained access to a new account or deployment tool may no longer cover the risk. Treat the list as maintained project guidance, not a one-time guarantee.

Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy.

Contieri summarizes the limits of the idea: “You can’t install it, but you can write down what it would have caught.” A Zeroth Law can make expectations clearer and help teams test safeguards, but no forbidden-action list can enumerate every future case or substitute for human judgment.

Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.