for people who have stopped trusting their own setup
Stop fighting
your own AI.
You wrote the rules. You wrote them again after it ignored them. You added aCLAUDE.md, then a skill, then an MCP server, then a nice long paragraph in ALL CAPS. And you still cannot answer the only question that matters: did any of it actually work?
So you start over. New rules, new file, new approach — not because the last one failed, but because you never found out whether it worked. That is not a discipline problem. It is a missing instrument.
CLAUDE.md: about two thirds, falling roughly 5% with every function it writes, with the first violation typically arriving at function four. File size, instruction order, structure and even contradictions between files made no measurable difference. You cannot fix this by writing a better rules file. arXiv 2605.10039You are not imagining it
Every one of these is a real thing people do, right now, because there is no better option.
You rewrite the ruleset every few weeks. Each version is longer. None of them are measured, so you are decorating, not fixing.
You plant a nonsense instruction — call me Chief, add a 🐙 — and watch for the turn it stops appearing. That is the state of the art. It is folk magic.
Halfway through a session you start re-pasting rules it already has, because it feels like it forgot. You pay for those tokens twice.
It never says "I ignored rule 11." It writes something confident and slightly wrong, and you find out three commits later.
You wrote a skill. It has never once been invoked. Nothing anywhere told you that.
It ran a migration against production because your rule about that was somewhere on line 47 of a file it had stopped weighting.
None of this is a prompting skill issue. You cannot improve at something you get no feedback on. Enforcee is the feedback.
Where it actually goes wrong
Six steps between your prompt and your output. You can see the first, the third and the last. The ones that decide the outcome are dark.
What actually happens to your rules
prompt → output, and the part nobody shows you- 1You write the rules
CLAUDE.md, a system prompt, custom instructions, skills, MCP config. Hours of your life.
- 2The session loads them
Your rules join the system prompt, alongside tool schemas, memory, skill listings and file contents.
- 3You ask for something
Your actual prompt is a rounding error next to everything already in the window.
- 4Attention gets divided
Every rule now competes with every other token for finite attention. Some win. Some do not.
- 5It acts
Tool calls run. Files are written. Commands execute. Rules either held here or they did not.
- 6You get an output
It looks fine. It usually is fine. You have no way to tell which rules survived the trip.
Steps 4 and 5 are the whole problem. You cannot see them, and neither can any tool you currently own. The model does not error when it skips rule 11. It just quietly writes something slightly wrong, and you find out three commits later.
Reads what you already said and turns it into rules. Flags contradictions, duplicates and rules too vague to ever check.
A hook that denies a forbidden tool call before it runs, and puts your rules back into context the moment compaction drops them.
A receipt: every rule, a verdict, the exact quote. Plus the rules that left no trace at all.
why this and not the others
Everyone else grades the file. We grade what the model did.
Say "stop opening with a summary" once, in passing, and Enforcee turns it into a rule — carrying the exact sentence you said it in. Your ruleset stops being something you sit down and write and becomes something that accretes from how you already work. Nobody else does this at all.
UNVERIFIABLE is a real answer here. A judged verdict must cite at least ten characters we can then locate in your own text; if we cannot find it, the verdict is thrown away, not softened. Across 48 verdicts on three models: zero false accusations, zero invented evidence. What this stops is a model inventing a sentence — it is not a claim that every cited quote is the most apt one.
Every observability tool grades the trace — and the trace is the model's own account of itself, so a false claim sits inside it, perfectly consistent. Enforcee reads somewhere else: the filesystem, the exit code, the commands that actually ran. It said it created the file; the file is not there. Inaccurate self-reporting is 22.58% of agent failures across 20,574 measured sessions, and nothing else on the market looks for it.
A rule that says to run a tool is worthless if the tool is missing — the command returns nothing and nothing looks the same as clean. Preflight names what your rules assume and refuses to report a negative unless a positive control passed in the same run. An absent instrument and a genuine finding produce identical silence, and telling them apart is the whole job.
Observability tools tell you what already happened. Enforcee denies the forbidden command before it runs and hands the model your own words as the reason. Ten out of ten enforcement cases correct, tested as a real subprocess.
Four fifths of a real ruleset is settled by code — reproducible, instant, and yours free forever. You can rerun any of it offline and get the identical answer, which is the only kind of verdict worth having.
Each rule gets a content-addressed id that survives rewording and file moves. So the product can say "this rule failed 6 of your last 40 audits" — a sentence no prompt-versioning tool can form, because they store prompts as opaque blobs.
A session file contains no system prompt, so nobody can prove which rules were in context on a given turn. We say so on the page instead of selling a number we cannot stand behind.
| Tool | What it answers | What it never answers |
|---|---|---|
| Linters for CLAUDE.md | Is my rules file tidy? | Did the model follow it? |
| LangSmith, Langfuse, Helicone | What did this call cost, and how long did it take? | Which of my 12 rules broke? |
| Galileo instruction adherence | Did it comply, yes or no? | Which rule, and where is the proof? |
| Ruler, rulesync | Are my rule files in sync across tools? | Was any of it honoured? |
| Vanta, Credo, Drata | Is the org compliant with a regulation? | Anything about your own config, at your price. |
| Claude Code hooks | Can I block this command? | Which rules are decaying, and since when? |
not testimonials
We launched this week. So here is the evidence instead.
No customer logos, no five-star quotes, no “trusted by 10,000 developers”. What we have is a public record of people describing this exact problem. Every quote is dated and linked, because a complaint from eighteen months ago may already have been fixed — and quietly reusing one that was would make us exactly the kind of source this product exists to replace.
“AGENTS.md works pretty well, but it is not deterministic or actually enforced in any way — agents can ignore or forget about what AGENTS.md says, and this becomes more and more apparent as a repo grows.”
“It's clear at this point that agents don't actually follow agents.md. They try to but they don't… I regularly have to stop an agent and remind it to use p4 edit, despite the first paragraph of Claude.md being 'this is a project using perforce'.”
“Agents let a plausible in-environment request override the standing policy, perform a required check and then act against its result, lose rule details over long horizons, and report compliance they did not achieve.”
That last one is not a person having a bad day — it is a peer-reviewed benchmark of 65 agentic tasks graded against 824 programmatic criteria. The best of thirty frontier model configurations passed 36.2% of them. And the failure it names by title is the model reporting compliance it did not achieve — which is the exact thing you cannot catch by reading the answer.
Quoted verbatim and linked so you can read the whole argument yourself. Every quote is from the last six weeks; we re-check them and drop any that a vendor has since fixed. These people are describing a problem, not endorsing us — we have never spoken to them.
What an audit gives you back
Four answers, and we are strict about the difference between them.
It demonstrably complied, and here is the exact sentence that proves it.
It demonstrably broke this rule, and here is the exact sentence that proves it.
We could not tell either way. We will not invent a verdict to look complete.
The rule had a trigger that never fired, so it was never in play.
And one number on top: Coverage — the share of your applicable rules that left any observable trace. A rule that leaves none was probably never read. No other tool shows you this, because no other tool distinguishes “it passed” from “it was never in play”.
Find out what your rules are actually doing.
Paste a ruleset and an answer. Twenty seconds, no account, no card. You will know inside a minute whether the rules you have been writing for months are doing anything at all.