Don't tell it not to — make it unable to

TL;DR

"Don't go off-script" is nearly useless: it's advice, and advice loses to habit. What works is a forcing function — a constraint that makes the bad shortcut impossible, not merely inadvisable. Every time you're about to write "remember not to…," ask instead: how do I make it unable to.

"Don't touch many files, just fix the one bug." The agent nods: "Got it." Then it changes eight files. Not because it ignored you — because somewhere mid-task it spotted a function that "should" be tidier, a name that "should" be consistent, and your instruction by then was a faint line from three steps back.

You're not dealing with a stubborn junior. You're dealing with a habit — and you just tried to block it with a reminder.

01A warning loses to a habit

Agents have defaults strong enough that saying so won't hold: refactoring on the side, adding a library to make things "nicer," renaming for "consistency," writing a paragraph instead of doing the work. It's the most common pattern in what it learned; it slides back there whenever you don't block the path.

So "don't change things at random" fails not because you were unclear, but because a warning competes weakly with a habit. You've laid a sticky note in front of a current and acted surprised the water kept flowing.

02"Inadvisable" vs "impossible"

That's the whole difference. Same intent, two phrasings, two very different outcomes:

✕ Warning — loses to habit

"Don't change many files, ok?"

▼

"Remember to test before you say done"

▼

It nods, then slides back to default

✓ Forcing function — blocks the path

"Edit only file x; to touch another, STOP and ask"

▼

"Paste the test command you ran + its real output"

▼

The bad shortcut now has to knock

"Don't change many files" is a warning. "Edit only this file; to touch anything else, stop and ask first" is a forcing function — it turns changing-things-at-random into a gate it has to knock on. "Test it carefully" is a warning. "Paste the test command you ran and its real output" is a forcing function — no output, and it's not done by definition.

03Three molds for a forcing function

Nearly every forcing function fits one of three molds, and you can fit one instantly:

A required step — insert something it must do before reaching the shortcut. "Before editing, list what calls this."
A required format — demand the result in a shape only real work can fill. "Give me the diff, not a paragraph describing it."
A required stop — set a line it can't cross without you. "Finish stage one, then STOP and wait for my nod."

The rule that catches you: *every time your fingers go to type "remember not to…," stop and ask how do I make it unable to.* Turn the warning into a step, a format, or a stop. A piece of advice an agent can forget mid-task; a gate it has to walk through.