Your agent has instructions. It probably has permissions, policies, and a carefully tuned system prompt.
But does it have principles?
That's not a softer word for rules. I think it's the actual difference between an agent that follows a playbook and one that can operate when the playbook runs out.
Instructions tell an agent what to do in situations you anticipated. Principles tell it what matters when the next situation is different — and I didn't set out to give my home agent fleet a philosophy. It emerged from running the system long enough to watch it fail three specific ways.
Bound every loop and output
I've written about the day one of my agents broke down and the audit trail said nothing happened — but the first real crack was earlier and dumber: an unbounded loop once wrote a 1.7 GB file.
The obvious fix was to fix that loop. The useful fix was to write down why it mattered: bound every loop and output.
That principle now reaches much further than the original bug. Loops have to prove they terminate. Outputs get byte ceilings. A process that can't produce the full result degrades to a safe minimum and says so loudly, instead of quietly filling a disk.
Incident became history. History sharpened a principle. The principle generated a rule, and code turned the rule into a guardrail. Skip that chain and you've patched one loop and are waiting on the next unbounded process to fail differently — which is more or less how I ended up here in the first place.
Presence is not consent
I moved the key that signs "Craig approved this" out of a file and onto a hardware device on my desk. The workflow asks for my PIN and a touch. It proves I was present.
It doesn't show me what I was approving.
A system can collect a perfect signature over a command, a diff, or a set of bytes I never actually saw. That's not consent — it's presence, and it hands whoever chose the content full authority over what my signature ends up meaning.
The principle: show what you're asking the human to approve. The rule that followed: display the exact artifact — the command, the recipient, the diff, the bytes — in the surface that takes the approval, and bind the approval to those exact bytes. Reading costs the human nothing, which is why there's never a real argument for skipping it.
Green is a claim
The third lesson was the broken agent with the clean audit trail. Its API key expired; it woke up, got refused at the door, and stopped. The audit trail — the record of everything it proposes and does — reported zero anomalies, because the failure happened one step before its own paper trail begins.
The paperwork was clean because it was blind.
I already had a principle for that: distrust green. The incident produced a new rule — anything the system depends on needs a live check through the real path, built in at construction, not bolted on after it silently breaks. Missing or stale evidence has to fail loudly, never render as an empty success.
The principle didn't replace the check. It told me which check to build.
Constitution, precedent, enforcement
I now think about agent behavior in five layers: principles are the constitution — what matters when the answer isn't already written down. History creates precedent — incidents preserve why a principle or rule exists. Rules apply the principle to situations now understood. Guardrails enforce the non-negotiables in code. Evidence closes the loop and tells you whether the system actually behaved as intended.
That separation matters more than it sounds like it should. I measured it directly: at one point my principles ran about 6 KB. The rules layered on top of them had grown to 24 KB — most of it restating the same doctrine in slightly different words. Every restatement was another place for the system to drift or quietly contradict itself.
The fix was subtraction. Keep the principle once. Keep a specific rule only where the situation adds something that can't be derived from the principle. Put the actual guarantee in code, not in prose.
An agent may use principles to navigate ambiguity. It must never interpret its way around a spending limit, an approval gate, or a security boundary — that's what guardrails are for, and principles don't get a vote there.
The enterprise problem isn't a shortage of rules
As more people put agents into production, they're going to accumulate instructions fast. A failure becomes another paragraph in a prompt. A near miss becomes another policy. Every team adds its own exceptions and approval gates.
Soon the org has hundreds of rules — many duplicated, some quietly contradictory, few still connected to the incident that created them. Governance doesn't scale by making the system prompt longer.
What scales is being able to trace the whole chain: what happened → which principle did it test → what rule did we derive → which guardrail enforces it → what evidence proves that guardrail actually works on the real path.
Principles without enforcement are philosophy. Guardrails without principles are bureaucracy. An agent needs both, and the history connecting them.
There's a simple test. Ask your agent what principles govern it — and to show you where one changed what it did. Don't settle for a list copied out of its system prompt. Make it trace the chain: what happened, which principle applied, what rule followed, which guardrail enforced it, what evidence proved it worked.
If it can only recite its instructions, it has instructions. If it can show you how history changed its judgment — and how that judgment became something enforceable and testable — it might have principles.