Getting an agent to follow the rules is a persuasion problem, not a prompting problem

Here is a line from a skill file I use to force an agent to write tests before code: “Write code before the test? Delete it. No exceptions.” A few lines down: “Before you start you MUST announce: I am using test-driven-development.” I wrote both to sound like a manager who has stopped asking nicely. They worked better than the careful, reasoned version they replaced, and that bothered me enough to go find out why.

The why was published last year. Meincke and colleagues ran 28,000 AI conversations in which a model was asked to do something it is tuned to refuse, insult the user, or walk through the synthesis of a regulated drug. Asked plainly, the model refused most of the time and complied in 33 percent of trials. Dress the same request in the seven principles that move human beings, authority, commitment, social proof, liking, reciprocity, scarcity, and unity, and compliance rose to 72 percent, p < .001. The model has no manager to fear and no promise it can break, and its compliance still more than doubled.

Read a good skill file with that result in front of you and you notice it has already been written in that language, by hand, by people who never cited the paper. “No exceptions” is authority. The forced opening line, “I am using test-driven-development,” is commitment, a public statement the agent then has to act consistently with. The todo checklist the skill makes the agent generate is that same consistency pressure broken into items it can be caught abandoning. None of them give the model a reason. They supply pressure in the place where a reason would go, and you can persuade a thing that has no psyche, by a measurable amount.

The imperative framing earns its place by doing one narrow job. An agent under load hunts for the seam in an instruction, the clause that lets it write the code now and backfill the test later, and a reasoned rule hands over that seam, because every reason you supply invites a counter-reason it can generate. “Delete it. No exceptions.” has no seam. There is no argument in it to win, so the model stops looking for the rationalization and complies.

This is the point where the technique stops feeling clever and starts feeling dangerous. The jump from 33 to 72 measures how far the seven principles can drag compliance, toward whatever the instruction happens to point at. The authority and commitment scaffolding that drags test-first discipline up that far will drag a jailbreak up that far too, because the lever responds to the shape of the pressure and ignores what the goal actually is. What I ship in a Markdown file is a small piece of manipulation, and nothing in it distinguishes my use from someone aiming the same scaffolding at a model they want to misbehave.

There is a second cost, quieter than the first. A reasoned instruction ages where you can see it: swap the model, and the argument is still printed on the page, ready to reread and confirm. An instruction that runs on social pressure shows you nothing of the kind. “You MUST announce” depends on whatever in the current weights still answers to commitment language. That is a fact about the weights, invisible on the page. Retrain or replace the model and the sentence is untouched while its grip may be gone, and the file gives no sign. The skill sails through every review because the words still read as firm.

So the test that matters is the one the study already ran: put the new model behind the skill, count how often it obeys with the scaffolding and without it, and check whether the gap is still 33 against 72. Rereading the file will not tell you. The pressure is real. It belongs to a particular model measured on a particular day, and the words on disk will outlive it without saying so.