A Rule Can Live in Five Places
"Move it into structure" sounds like one action. It is really a ladder with five rungs, and knowing which rung you are on tells you exactly what you are still exposed to.
Rung 1 — advice. The rule lives in a document somebody read once. It governs nothing at decision time.
Rung 2 — reminder. The rule is present in the working context, right where the work happens. Better, and still the losing side of the attention contest from the previous lesson.
Rung 3 — detector. A check runs afterward and reports violations. This is the first rung that produces evidence instead of hope. It has one structural blind spot, which is large enough that the whole of the third track is about it.
Rung 4 — refusal. The tool declines the action. Not a warning, not a confirmation dialogue — the call fails and says why.
Rung 5 — absence. The affordance is not there. There is no path to the forbidden thing because nothing ever handed one over.
Rungs 1 and 2 are discipline. Rung 3 is evidence. Rungs 4 and 5 are structure. Most process failures are people trying to solve a rung-4 problem by writing a better rung-1.
Climbing Is Not Free, and Not Always Right
Every rung costs more than the one below it, and rung 5 is not automatically the goal. Absence is only available when the input is genuinely not needed. If a stage must write files, it must know paths; you cannot withhold what the work requires. That is why a real system lands on different rungs for different rules, deliberately, and writes down which.
The other cost is over-constraint. A refusal that fires when it should not is a tax on every future run, and the person paying it will eventually switch it off — which returns you to rung 1 with extra steps. The design answer is to make the guard fail in the direction that is visible and repairable: refusing too much announces itself loudly and gets fixed, while refusing too little is silent and gets discovered by an audit a month later.
The Move That Makes It Cheap
The reason this is affordable at all is that the placement itself becomes data. When each pipeline declares which of its stages close which inputs, adding a guard to a new pipeline is a line in a registry rather than a fork of the engine. The rule stops being prose in five templates and becomes one field that the harness reads.