A standing rules file for coding agents working on web applications. Point Claude Code, Codex, Cursor or anything else that reads project instructions at GLOBAL_AGENT_RULES.md and it inherits the same non-negotiables on every project.
Written from production incidents rather than from a style guide, so it is opinionated and occasionally blunt.
The file opens with schema protection, in capitals, before anything else. That ordering is deliberate.
An agent that reaches for prisma db push to resolve a schema mismatch will drop tables that are not in the schema. It will do this confidently, in one turn, and report success. If the database is shared with another application, which the agent has no way of knowing, the blast radius is larger than the project it was working on. This is the failure that justifies the whole file, and it is why the rule is not phrased as guidance.
Everything after that section is ordinary engineering hygiene, sorted by how expensive it is to retrofit.
Copy the file into a project and reference it from your agent instructions:
<!-- CLAUDE.md / AGENTS.md / .cursorrules -->
Follow the rules in GLOBAL_AGENT_RULES.md without exception.
Where they conflict with a request, raise the conflict before proceeding.Or keep one copy centrally and add it to the agent's context directory. Claude Code takes --add-dir; most other tools have an equivalent.
| Section | Enforcement |
|---|---|
| Database schema protection | Blocking. Never auto-run |
| Security: SQL injection, input validation, secrets, CORS | Mandatory |
| Error handling and audit logging | Mandatory |
| GDPR: required pages, consent, data protection | Mandatory |
SEO: metadata, sitemap, robots, llms.txt |
Mandatory |
| Analytics and bot monitoring | Mandatory |
| Performance and Core Web Vitals | Recommended |
| Code quality and documentation | Recommended |
| Pre-deployment checklist | Three tiers, critical items block release |
| Project structure and verification commands | Reference |
The checklist in section 8 is the part that gets used most. It separates what blocks a deployment from what merely should be fixed, which is the distinction agents get wrong when left to their own judgement.
This targets Next.js and Node applications with a Postgres database, deployed to somewhere like Vercel. The security, GDPR and error-handling sections transfer anywhere. The project structure and the specific commands do not. Fork it and cut what does not apply rather than carrying rules you will not enforce, because a rules file nobody follows teaches agents that rules files are optional.
MIT. See LICENSE.