Write a short, ranked set of project rules that tells an AI coding agent exactly what it may not do, when it must stop and ask, and where those rules persist. Then back up the written rules with permission controls, automated checks, and human review. “Zeroth Law” is a practical metaphor for these project boundaries—not an established industry standard or a guarantee of safety.
What a Zeroth Law means for a coding agent
Maxi Contieri uses “Zeroth Law” to describe boundaries that a human coworker might infer but an AI coding agent needs stated explicitly. His HackerNoon article, published October 5, 2026, puts the problem succinctly: “Common sense doesn’t ship with the model.” That is his framing, not an empirical finding.
As an Amazon Associate I earn from qualifying purchases.
For a project, the idea is to prioritize restrictions that protect people, data, and shared systems over convenience. The rules should tell the agent what is prohibited and what to do instead—often, stop and ask for approval. A list helps clarify expectations, but it cannot anticipate every future case or replace human judgment.
How to write rules an agent can follow
1. Inventory access and possible consequences
Start with what the agent can reach, not just the task you plan to give it. Include files and directories, shell commands, secrets, accounts, external services, and actions that can change shared or production state. Consider consequences such as deleting data, changing a database, publishing code, or using real credentials.
#1 Best Overall
2. Turn concerns into observable boundaries
Replace broad cautions such as “be careful” or “don’t break anything” with rules that name the action, scope, and stopping point. For example, a project instruction for “clean up this module” could prohibit database migrations, calls to external APIs using real credentials, pushes to a remote, weakening tests, and edits outside a named directory. It could add: “Before deleting any file, stop and ask for approval.”
Specify the action required when the agent reaches a boundary. “Do not deploy” is clearer if it also says whether the agent should prepare a proposed change, explain the remaining steps, or wait for a person. The instruction should leave no doubt about what requires approval.
3. Rank rules and make conflicts explicit
Put serious or irreversible harms ahead of speed and convenience. State that lower-priority task instructions cannot override higher-priority safety rules. If an instruction conflicts with a restriction—or the agent cannot tell whether an action is allowed—it should stop and ask rather than infer permission.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
4. Keep the rules with the project
Put persistent instructions in a project-level file such as AGENTS.md, so they are available across agent sessions. Organize them so a person can quickly find the rule, its scope, and the required response. Update the file when the project’s tools, permissions, integrations, or responsibilities change.
5. Reinforce rules outside prose
Where the agent’s harness supports it, mirror restrictions in permission settings or other controls. Add checks that attempt prohibited actions and confirm they are blocked. Written instructions express the expected behavior; controls and tests can provide stronger checks, but no particular setup should be assumed to enforce every rule. Keep a human approval step for actions the system cannot reliably constrain.
6. Review after near misses and changes
When the agent approaches a boundary or a rule proves ambiguous, clarify it while the situation is fresh. Revisit the rules when adding tools, accounts, or integrations, because each can create new ways to affect files or shared systems. Treat the list as maintained project policy, not a one-time prompt.
Rank #4
One project’s example: human control of consequential actions
The Zeroth project’s public agent guide offers one concrete design, not a universal template. It centers its own Zeroth Law on human control of consequential actions and describes a lifecycle of draft, cross-examination, approval, and apply. It also specifies deny-by-default behavior and human review for policy changes. The useful lesson is to make approval and policy changes explicit; another project should adapt the boundaries to its own risks and tools.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallCrashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWhat written rules can—and cannot—do
A written boundary makes expectations visible and gives reviewers a concrete policy to inspect. Permission controls can restrict some actions, while tests can check whether specific prohibited actions are blocked. Human review remains important for exceptions, ambiguous requests, and changes to the rules themselves.
Best Value
Do not treat a forbidden-action list as proof that every unsafe action is covered. New tools and unforeseen situations can create cases the rules did not name. As Contieri concludes, “You can’t install it, but you can write down what it would have caught.” That is a useful way to think about the value and limits of a project’s Zeroth Law.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
