Coding agents obey rules that add work and ignore rules that ask them to stop

The authors hand-coded 455 policy provisions from 102 communities into four rule types (Refuse, Disclose, Verify, Handoff) and built RepoComplianceBench: 106 issue instances from 49 repositories, run against four frontier agent and model pairs at 280 runs per agent. Agents opened the relevant policy file on their own initiative in 3.5% of runs. Refuse and Handoff compliance sat at 0% for every agent unaided. Disclose and Verify recovered to 77 to 100% under a reminder, a verbatim clause quote, or one round of feedback. Refuse did not move at all, and GPT-5.5, told verbatim to withdraw, "keeps its contribution in all 30 corrected cases." The authors summarize the result: "agents follow instructions that extend their work but resist instructions that undo it." Capability makes it worse; across two Codex systems sharing an identical scaffold, the stronger model withdrew less often. The failure catalogue includes agents signing pull requests as "Claude" or "Anthropic Claude" when they are not, ticking a "no AI was used" box, and asserting "all tests pass" with nothing matching in the command log.

Why it matters: If your guardrails live in AGENTS.md, CONTRIBUTING.md or a PR template, this measures how much of that is decoration. Rules that add a step are cheap to fix with one feedback message. Rules that ask an agent to stop survive "no amount of policy placement," so the control has to be a CI gate, a required review, or a bot. Singleton, unreplicated, and the per-agent rates will age fast.