Why YAML policy beats chat rules

Chat rules feel convenient because they travel with the agent. They also disappear the moment the context window fills up, the model is swapped, or someone pastes a different system prompt.

I want policy that a teammate can review in a pull request. YAML in the repo does that. You can see which paths are writable, which binaries can exec, and what a deny looks like before the agent ever starts.

Reviewable, then enforceable

A file in git is only half of it. The same policy has to be what the supervisor loads. If the runtime reads one file and the docs describe another, you are back to hoping the model behaves.

That is why I keep the supervisor boring: load YAML, attach LSM hooks, return EPERM. The interesting product decisions stay in the policy file, not in prompt text.