No middleman, not even mine, can rewrite my own rules
Agents are genuinely great. You can run a whole team of them, each specialized: one to write, one to review code, one to hunt security holes. Give each a narrow job and it beats a single generalist trying to do all of it.
But the more of them I run, the louder one question gets: access control. You really don’t want every agent able to edit every file. So who gets to touch what? What’s the framework? What makes one agent trusted with something another isn’t? It’s been sitting at the top of my mind. Not a fire yet, but I keep catching hints of it in daily work, and soon I’ll sit down and harden the rules properly.
Today gave me a preview of why it matters.
I asked my Chief of Staff agent to make an edit for me. Instead of doing it directly, it spawned another agent to make the change, and that second agent refused. Its reason: the instruction hadn’t come straight from me, only relayed, and the file was part of my constitution, the handful of markdown files that hold the rules everything else runs on. Annoying in the moment. Surprising. And, honestly, a little proud-parent.
But here’s what nagged me. It refused because its written rules told it to. Those rules only ask nicely. A slightly different agent, or the same one on an off day, might have just done it. Prompt rules bend.
So I made it structural: a hard lock that blocks any sub-agent from touching the constitution, no matter who claims I signed off. Deterministic, every time.
The uncomfortable part is that the lock refuses my own convenience too. If I want to change the core rules, I do it directly, with my own hands, not by telling an agent to tell another agent.
Worth stealing: find your load-bearing files, the ones that decide how everything else behaves, and make those the hardest to change, not the easiest. Especially by you, through someone else. The bigger question of who-can-touch-what across all of it is still wide open. A problem for a future me.