Notifications
Clear all
Topic starter
26/08/2026 11:50 am
TL;DR: Ting Yan’s analysis of 481 public CLAUDE.md files found that only 4.4% of security rules had a built-in control covering the whole rule, because most agent permission models cannot express conditions, content checks, or approval logic. The result is a write-only governance channel where policy intent exists, but enforcement feedback does not, according to Cakewalk and the referenced arXiv paper.
NHIMG editorial — based on content published by Cakewalk: Most CLAUDE.md security rules have no built-in control that matches them
By the numbers:
- Only 4.4% of the rules had a control covering the whole rule.
- The extractor caught 66.3% of the security rules in a file.
- The corpus included 481 public CLAUDE.md files.
Questions worth separating out
Q: What breaks when CLAUDE.md rules do not map to agent controls?
A: The rule becomes advisory instead of enforceable.
Q: Why do security rules for coding agents fail in practice?
A: They fail when the rule depends on context the control cannot see, such as content, system state, or a human approval moment.
Q: How can teams tell whether a CLAUDE.md rule is actually enforceable?
A: Check whether the platform can bind the rule to the exact action, target, condition, and approval path.
Practitioner guidance
- Map every CLAUDE.md rule to an enforceable control Review each written rule and verify that the agent platform can technically enforce the same action, target, condition, and approval path.
- Separate approval language from true approval gates Audit any ask before or similar wording and confirm that the agent cannot continue until a real human checkpoint or policy engine decision occurs.
- Test content, condition, and data-flow rules explicitly Prioritise rules that depend on secret material, release state, or outbound model calls, because these are the cases where command-level controls usually fail.
What's in the full report
Cakewalk's full analysis covers the operational detail this post intentionally leaves for the source:
- The paper’s rule classification method, including how candidate security segments were extracted from 481 public CLAUDE.md files.
- The breakdown of rule types that failed to map cleanly to built-in controls, including condition-based, content-based, access-control, and data-flow cases.
- The confidence interval and adjudication method behind the 4.4% coverage figure, which matters if you need to assess the strength of the evidence.
- The exploratory corpus characteristics, including the relevance-ranked GitHub sample and why the authors do not generalise the result to all projects.
👉 Read Cakewalk's analysis of CLAUDE.md security rules and agent control gaps →
CLAUDE.md rules versus agent controls: where the governance gap is?
Explore further
26/08/2026 11:51 am
Write-only policy is a control failure, not a documentation quirk. CLAUDE.md lets teams state rules for coding agents, but the article shows that most rules do not map to built-in controls. That means the security team can publish intent without being able to prove enforcement. In identity terms, the policy exists outside the enforcement plane, which makes it ineffective as governance.
A few things that frame the scale:
- The average estimated time to remediate a leaked secret is 27 days, despite 75% of organisations expressing strong confidence in their secrets management capabilities, according to The State of Secrets in AppSec.
- Only 44% of developers are reported to follow security best practices for secrets management, which helps explain why policy intent often outruns actual control behaviour.
A question worth separating out:
Q: Should organisations rely on natural-language instructions for agent governance?
A: No, not on their own. Natural-language instructions are useful for intent, but governance requires machine-enforced checkpoints, logging, and review states. If the agent can still execute the action without a technical gate, the instruction is guidance, not control. Policy text should complement, not replace, enforcement.
👉 Read our full editorial: CLAUDE.md security rules often outpace agent controls
