Pair Every Prompt Rule with a Code Backstop

PROJECT CONTEXT:
My agent's safety currently lives entirely in prompt wording, and the model ignores it just often enough to be scary. Claude Code's answer is two independent layers: prompts make the model want to do the right thing, code makes the wrong thing impossible - and when they conflict, code wins.

GOAL:
Build the dual-defense architecture: map prompt rules to enforcement needs, implement code checks independent of prompt wording, and route violations through allow/ask/deny.

REQUIREMENTS:
- An inventory of every behavioral rule currently expressed only in prompts
- Each rule classified: guidance-only, or requires code enforcement
- Code checks that work even if the prompt is deleted entirely
- A three-way outcome for checks: allow, ask (user confirms), deny (clear malice only)
- Failure-mode analysis covering all four prompt/code success-failure combinations

CONSTRAINTS:
- The code layer must never import or parse prompt text - full independence
- Prefer ask over deny: keep the user in control except for unambiguous danger

DEFINITION OF DONE:
- Every destructive-class prompt rule has a matching code check
- Deleting the prompt rule leaves the code check fully functional (tested)
- A prompted-but-violated action triggers ask or deny, never silent execution
- The four failure combinations are documented with mitigations

COMMON FAILURES TO AVOID:
- Prompt-only safety: one bad sample away from a destructive action
- Code-only safety: the model floods the gate with denied attempts because nothing guides it
- Code checks keyed to prompt phrasing, breaking when the prompt is reworded
- Everything denied outright, training users to bypass the agent entirely