Topic starter
26/08/2026 11:50 am
TL;DR: Ting Yan’s analysis of 481 public CLAUDE.md files found that only 4.4% of security rules had a built-in control covering the whole rule, because most agent permission models cannot express conditions, content checks, or approval logic. The result is a write-only governance channel where policy intent exists, but enforcement feedback does not, according to Cakewalk and the referenced arXiv paper.
Editorial analysis by NHI Mgmt Group, based on content published by Cakewalk: “Most CLAUDE.md Security Rules Have No Built-In Control That Matches Them”.
By the numbers:
- Only 4.4% of the rules had a control covering the whole rule, with a 95% confidence interval of 2.6 to 6.7.
Key questions
Q: What breaks when CLAUDE.md rules do not map to agent controls?
A: The rule becomes advisory instead of enforceable.
Q: Why do context-based agent rules fail more often than simple allow or deny rules?
A: Because context-based rules depend on state the control plane does not naturally encode, such as release status, what a commit contains, or whether a human has approved the action.
Q: How should security teams tell whether an approval rule is really enforced?
A: They should trace the rule to a concrete approval gate in the runtime and confirm the agent cannot proceed without it.
Practitioner guidance
- Map every CLAUDE.md security rule to an executable control Classify each rule by whether it can be enforced through allow or deny settings, content inspection, approval gates, or other runtime controls.
- Separate content-based rules from command-based rules Create a distinct handling path for directives that depend on commit contents, release state, or semantic meaning.
- Verify approval rules at the runtime gate Check that ask before style instructions actually force a human decision point before the agent can proceed.
Bottom line: CLAUDE.md can capture security intent without guaranteeing that a coding agent can enforce it, so policy text alone is not a control.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
26/08/2026 11:51 am
CLAUDE.md has become a governance signalling layer, not a control layer: the article shows that developers can write security intent into agent instructions without gaining assurance that the agent can enforce it. That changes the governance question from whether policy exists to whether the control plane can represent the full rule. Practitioners should treat instruction files as evidence of intent, not evidence of control.
A few things that frame the scale:
- Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
- Only 44% of developers are reported to follow security best practices for secrets management, exposing a significant developer behaviour gap, according to the State of Secrets in AppSec.
A question worth separating out:
Q: What is the difference between policy intent and control enforcement in agent governance?
A: Policy intent is the instruction a person writes, while control enforcement is the mechanism that stops or permits the agent at runtime. In agent governance, the distinction matters because written rules can look complete even when the control model cannot express the relevant condition, content check, or approval requirement.
👉 Read our full editorial: CLAUDE.md security rules often outpace agent controls