{
  "uid": "cogitave.learn.apply-the-agents-floor.the-seven-rules",
  "kind": "moduleUnit",
  "href": "/modules/apply-the-agents-floor/the-seven-rules/",
  "title": "The seven non-negotiable rules",
  "summary": "",
  "type": null,
  "products": [],
  "roles": [],
  "levels": [],
  "subjects": [],
  "headings": [
    "1. English only",
    "2. Conventional Commits 1.0.0",
    "3. Signed commits",
    "4. Docs-as-code",
    "5. Least privilege",
    "6. Autonomy within the rails is the default",
    "7. The human gate is an exception handler, not a routine checkpoint"
  ],
  "source": "The root [`AGENTS.md`](../../../../../AGENTS.md) lists seven non-negotiable rules\nunder *\"Non-negotiable rules (the floor)\"*. Here they are in order, each with the\none thing you must remember and the standard that owns the detail.\n\n## 1. English only\n\nAll code, comments, commits, docs, identifiers, and PR text are in English. No\nother natural language anywhere. This keeps every diff readable by every\ncontributor and every auditor, regardless of who or what wrote it.\n\n## 2. Conventional Commits 1.0.0\n\nEvery commit message is `<type>[scope][!]: <desc>`. The type carries meaning:\n`feat` and `fix` drive versioning, `!` or a `BREAKING CHANGE:` footer marks a\nbreak. The rule and its full type list live in\n[commits-versioning](../../../../standards/docs/standards/commits-versioning.md).\n\n## 3. Signed commits\n\nCommits are SSH-signed and show as `Verified`. Unsigned commits are **rejected**,\nnot warned about. Never disable signing to get a commit through.\n\n## 4. Docs-as-code\n\nIf code changes, docs change. A change that touches code but leaves\n`docs/`, any `*.md`, or the `CHANGELOG` untouched is incomplete. The governing\nstandard is [documentation](../../../../standards/docs/standards/documentation.md).\n\n## 5. Least privilege\n\nDefault deny. Request only the capabilities a task actually needs, and **never\nbroaden a grant to make a step easier**. Access is through teams and roles, not\nper-person grants, with separation of duties between author, approver, and\ndeployer. See [authorization](../../../../standards/docs/standards/authorization.md).\n\n## 6. Autonomy within the rails is the default\n\nCorrectness is enforced by construction, so an agent acts unattended **while it\nstays inside its least-privilege grant**, its typed and schema-validated inputs\nand outputs hold, policy-as-code passes, its effects are reversible or canaried\nunder a blast-radius cap, and the eval/red-team gate is green. Every autonomous\naction is still traced as WORM evidence. The owning doctrine is\n[autonomy-and-oversight](../../../../standards/docs/standards/autonomy-and-oversight.md).\n\n## 7. The human gate is an exception handler, not a routine checkpoint\n\nA human is summoned on an **exception**, not over every correct action: (1) an\nautomated check fails; (2) confidence is low or the case is novel; (3) drift, an\nanomaly, or a policy violation is detected; or (4) an action in the minimal\nalways-human set - at Day 0 the `apply` / `merge` / `release` / secret-rotation /\norg-settings ceiling, plus irreversible-catastrophic actions such as root-CA\nceremonies, billing, mass data deletion, external publication, and sovereignty\nchanges.\n\n> [!NOTE]\n> Rules 6 and 7 are one idea in two halves: strong rails let in-spec work run\n> unattended, and the human is the handler for the exceptions. \"Agents propose,\n> humans enact\" is the Day-0 posture the ceiling in rule 7 encodes.\n",
  "partOf": "cogitave.learn.apply-the-agents-floor",
  "durationInMinutes": 7,
  "quiz": null
}