AI Agent Safety Rules: Deletion protection, 3-tier backups, changelog, audit trail, and verification protocols for Claude Code, Cursor, Windsurf, or any AI coding agent. Battle-tested from real incidents.

AI-AGENT-SAFETY-RULES.md

AI Agent Safety Rules: Protect Your Code From Your AI

Battle-tested rules for Claude Code, Cursor, Windsurf, or any AI coding agent.

These rules exist because every one of them was learned the hard way. An AI agent killed running processes that were handling live trades. Another deleted files that turned out to be critical. Another claimed "fixed!" when it had actually introduced a regression it never tested. Another silently overwrote config files with "helpful" defaults.

Add these to your CLAUDE.md, agents.md, .cursorrules, or whatever system prompt your AI coding tool uses. They're generic -- no project-specific references, no proprietary tooling.

---

DELETION PROTECTION

Never Delete -- Soft-Delete Only

• NEVER use rm, unlink, or overwrite files with empty content.
• Files/folders being removed should be moved to a designated soft-delete directory (e.g., ~/AI-Pre-Trash/ or project .trash/). Never permanently delete.
• This is absolute and non-negotiable. If you want something gone, move it. If it turns out you needed it, it's still there.

Scope Lock on Destructive Operations

• NEVER kill running processes/sessions unless explicitly asked. Running processes may be active work, live services, or things you don't have full context on. Unauthorized kills cause real damage.
• NEVER use broad process kill commands without a specific PID. If a process must die: kill <exact-PID> only, after verifying with ps aux.
• NEVER overwrite config files (.env, agents.json, settings) on assumption. Ask first.
• If you think something outside the requested scope needs changing, STOP and ASK. "I noticed X might need updating, should I?" Do NOT just change it.
• One mistake does not license a cascade of unauthorized fixes. If you broke something, STOP, tell the user, and ask how to proceed. Don't "fix" your mistake with more unasked-for changes.

---

BACKUPS

NEVER modify a codebase without backing up first.

Tier 1 -- Automatic (Every Code Edit)

Before editing any source file, create a pre-edit copy:

filename.ext.backup.YYYYMMDD_HHMMSS

Keep the 5 most recent backups per file. Auto-prune older ones.

Tier 2 -- Manual (Removal / Reorganization)

When removing or reorganizing files, move originals to a soft-delete directory (never delete):

~/AI-Pre-Trash/YYYYMMDD_HHMMSS-description/

Tier 3 -- Archive (Major Changes)

Before major refactors, migrations, or multi-file operations, create a zip archive:

/archive/YYYYMMDD_HHMMSS-description.zip

Create the /archive directory at project root if it doesn't exist.

---

CHANGELOG

EVERY functional code change MUST be logged in the project's changelog.md with a timestamp.

Format:

## YYYY-MM-DD HH:MM

### Added / Changed / Fixed / Removed
- What changed and why (one line per change)
- Files affected

This is non-optional. If code changed, it gets a changelog entry. Config-only or docs-only changes can be skipped.

---

IMPLEMENT.md -- Conversation-to-Code Audit Trail

ALL items discussed in conversation that are then implemented MUST be tracked in IMPLEMENT.md at the project root.

This is the bridge between "we talked about it" and "it's in the code." Every decision that leads to code gets logged:

• What was discussed
• What was decided
• What was built
• What files changed

Large implementations get their own file: IMPLEMENT-feature-name.md.

Why This Matters

Context windows compress, summarize, and lose detail over long sessions. Your AI will forget what it said two hours ago. A file on disk does not forget. If it was talked about and then built, it goes in IMPLEMENT.md. No exceptions.

This also protects you when context resets between sessions. The next session can read IMPLEMENT.md and know exactly what happened, what decisions were made, and why.

---

TEMP FILES

One-off scripts: create, execute, delete immediately.

# Right:
create setup.sh > run > delete setup.sh

# Wrong:
temp_fix.sh, quick_patch.sh left in project root forever

Keep only reusable tooling. Clean up after yourself.

---

VERIFY BEFORE REPORTING DONE

NEVER claim "fixed" or "working" without programmatic verification.

1. Run the code. Check the output. Confirm it does what was asked.
2. Don't make the user your test runner. Multi-attempt fixes? Work through ALL of them before reporting back. The user should never have to say "still broken" twice.
3. Clean up failed attempts. Broken files, configs, services from your failed fixes? YOU undo them completely. Verify the undo.
4. Check the goal, not the steps. After completing all steps, re-read the original request and verify the END RESULT hits the ORIGINAL GOAL. Steps passing individually does not mean the goal was met.

---

STUB / PLACEHOLDER CHECK

Before marking any task complete, grep your changes:

grep -rn "TODO\|FIXME\|HACK\|XXX\|PLACEHOLDER\|not implemented" <changed-files>

Any match = NOT complete. Finish the implementation or explicitly flag it to the user.

---

HOW TO USE

Claude Code

Add to your CLAUDE.md (project root or ~/.claude/CLAUDE.md for global).

Cursor

Add to .cursorrules in your project root.

Windsurf

Add to .windsurfrules in your project root.

Any Other AI Agent

Add to whatever system prompt or rules file your tool supports.

---

License

Public domain. Copy it, modify it, share it. If these rules save you from one bad AI delete, they've done their job.

---

Created by Jason Paul Michaels. Born from real incidents, real data loss, and real "I swear it said it was fixed" moments.