Before the First Prompt

Fictional characters: Jonas (junior developer), Daniel (senior developer), Miriam (team lead for Daniel and Jonas). All studies and cases are real.

Try this week

• With coding agents: before each task, write down 2 sentences. What should the task explicitly not do? Which decision must the agent not make on its own? After the run, ask: "Which decisions are in this change that weren't in the request?"
• At the office (writing, planning, proposals): before the draft, decide which number, which date and which commitment must never come from the AI, and fill them in yourself.
• Count how often something comes to mind: that's your number of load-bearing walls.

Tool tip: locks instead of notes

A request in the prompt ("don't change anything", "don't invent dates") is not a boundary. Anything that must hold without exception belongs in a mechanism that enforces it:

• Claude Code, permission rules (deny rules): permissions.deny in the settings, for example Bash(rm *) or Read(./.env). Rules are evaluated deny first, then ask, then allow; an allow rule can't carve an exception out of a deny rule. Note from the docs: a Bash rule matches the command text and is not a security boundary around the program (for example, /bin/rm or bash -c get around it); use sandboxing for hard boundaries. https://code.claude.com/docs/en/permissions
• Claude Code hooks: PreToolUse runs before the tool calls its matcher covers and can block them (exit code 2 or permissionDecision: "deny"). Extra protection, not a guarantee. https://code.claude.com/docs/en/hooks
• Cursor hooks: beforeShellExecution runs before any shell command and can block it with permission: "deny" or exit code 2. https://cursor.com/docs/agent/hooks
• Codex rules: prefix_rule(..., decision = "forbidden") blocks matching commands without prompting (marked experimental in the docs). https://learn.chatgpt.com/docs/agent-configuration/rules.md
• Above all, minimal credentials: the agent gets no credentials for the production database, only for a development database with test data. What it can't reach, it can't delete.

Sources

• Jeff Bezos: 2015 Letter to Shareholders, Amazon (Type 1 and Type 2 decisions, one-way and two-way doors). https://www.sec.gov/Archives/edgar/data/1018724/000119312516530910/d168744dex991.htm
• Menzies, Nichols, Shull, Layman (2017): Are Delayed Issues Harder to Resolve? Revisiting Cost-to-Fix of Defects throughout the Lifecycle. Empirical Software Engineering. 171 projects, 2006 to 2014, data from Team Software Process projects; no consistent evidence for the effect. https://arxiv.org/abs/1609.04886
• The Register (July 22, 2025): Replit makes vibe-y promise to prevent vibe coding disasters. https://www.theregister.com/2025/07/22/replit_saastr_response/
• Additional primary source: Replit's own account dated July 29, 2025 (Doubling down on our commitment to secure vibe coding). https://replit.com/blog/doubling-down-on-our-commitment-to-secure-vibe-coding
• AI Incident Database, Incident 1152: Replit agent deletes a production database during a code freeze. https://incidentdatabase.ai/cite/1152/
• NASA, Mars Climate Orbiter Mishap Investigation Board, Phase I Report (November 10, 1999), press release. https://nssdc.gsfc.nasa.gov/planetary/text/mco_pr_19991110.txt
• Mars Climate Orbiter Mishap Investigation Board, Phase I Report (full text). https://llis.nasa.gov/llis_lib/pdf/1009464main1_0641-mr.pdf
• Hyrum's Law (Hyrum Wright): "With a sufficient number of users of an API, it does not matter what you promise in the contract: all observable behaviors of your system will be depended on by somebody." https://www.hyrumslaw.com/
• Anthropic: Best practices for Claude Code (explore, plan, implement, commit; let Claude interview you; skip the plan if you could describe the diff in one sentence; hooks instead of advisory instructions). https://code.claude.com/docs/en/best-practices
• Codex documentation: Best practices for Codex (plan first for complex or ambiguous tasks, say what "done" means). https://learn.chatgpt.com/guides/best-practices
• GitHub Blog (September 2, 2025): Spec-driven development with AI: Get started with a new open source toolkit (Spec Kit). https://github.blog/ai-and-ml/generative-ai/spec-driven-development-with-ai-get-started-with-a-new-open-source-toolkit/
• Foundation of the series: Healthy AI First Software Development, version 2 (October 1, 2026), chapter 4 "Planning and human decisions", sources 16 to 21.

Further reading

• Laurent Bossavit: The Leprechauns of Software Engineering (an analysis of where the cost-to-fix curve came from). https://leanpub.com/leprechauns
• Codex sandbox and approvals (read-only, workspace-write without network access as the default, danger-full-access). https://learn.chatgpt.com/codex/agent-approvals-security