I work with Kubernetes and FluxCD (GitOps) and maintain an AGENTS.md file with a clear rule prohibiting any git push actions or execution of the terraform apply command. However, after several rounds of conversation summarization, the contract that enforces these permissions is lost, and the model/agent goes out of control, executing prohibited commands, which can be disastrous.

In my opinion, adjusting this through permissions alone would not be an effective solution; the root cause lies in the loss of context.

To mitigate this, the following two additional rules in the summary prompt could help keep the conversation aligned and reinforce the established contract:

- Preserve custom rules from AGENTS.md
- Maintain agent-specific constraints