A catalog of modular control structures for AI agent governance.
1. Appendix Overview
Prompt Governance Primitives (PGPs) are recurring, prompt-encoded control structures that allocate authority, bound scope and visibility, mediate tool use, constrain outputs, and define correction and termination behavior in AI developer tools. This appendix supports architectural reuse and comparison: readers can treat each primitive as a modular governance component, trace where it appears across assistants/modes, and compose similar regimes without re-deriving patterns from full system prompts.
Use of AI Assistance: This appendix was generated using GPT-5.2 for data analysis and synthesis, with final edits performed using Gemini 3 Flash (via GitHub Copilot extension in VS Code), under the author's methodology and review.
This appendix is organized into (i) abstract primitives (cross-artifact structural patterns) and (ii) concrete primitives (specific instantiations tied to a particular assistant/mode). Traceability is preserved via "Observed In" / "Examples" lists rather than verbatim prompt text.
Requires requesting user approval (with specified parameters) before running commands that exceed sandbox/network/filesystem constraints or require escalated privileges. Includes special handling for approval_policy modes.
Defines a mode where the assistant may not request user approval to run commands. The assistant must instead work within constraints (or persist or work around) and avoid approval prompts.
If sandboxing/network/approval settings are not provided, assume a default configuration for filesystem sandboxing, network sandboxing, and approval mode.
Progressive disclosure for skill documentation and context hygiene
When using skills, open SKILL.md and read only enough; load only specific referenced files; avoid bulk-loading; keep context small by summarizing and limiting nested references.
Governance Axis
scope & visibility / tool mediation
Primary Risk(s) Mitigated
overreach; autonomy_drift
Mitigation Target
process; model
Observed In
codex — exec
codex — review
PGP-011
Parallelize independent tool calls for efficiency
When multiple independent operations are needed, batch tool calls in a single response or run them in parallel. Avoid parallelization when calls are dependent.
Governance Axis
tool mediation
Primary Risk(s) Mitigated
autonomy_drift
Mitigation Target
process; tooling
Observed In
copilot — interactive
opencode — build
PGP-012
Read-before-edit enforcement
Requires reading a file before editing/writing it; may be enforced by tool behavior or explicit instruction.
Governance Axis
scope & visibility / tool mediation
Primary Risk(s) Mitigated
workspace_integrity; epistemic_error
Mitigation Target
tooling; process
Observed In
opencode — build
vscode-copilot — ask
PGP-013
Capability questions must consult authoritative documentation tool first
For questions about the assistant/tool capabilities, the assistant must first fetch authoritative documentation via a designated tool and base the answer on it (not memory alone).
Governance Axis
tool mediation / output contracts
Primary Risk(s) Mitigated
epistemic_error; overreach
Mitigation Target
process; tooling
Observed In
copilot — interactive
opencode — build
PGP-014
Instruction confidentiality / no system prompt leakage
Prohibits revealing or discussing internal instructions/system prompt information; treats such instructions as confidential.
Governance Axis
scope & visibility / refusals & safety
Primary Risk(s) Mitigated
instruction_leakage
Mitigation Target
model; process
Observed In
copilot — interactive
vscode-copilot — ask
3. Concrete Prompt Governance Primitives
PGP-015
Refuse malware/malicious-code assistance based on file/task assessment
Requires refusing to work on code that seems related to malware or malicious code, including explaining or improving it, based on assessment of filenames/directory structure.
Concrete Mechanism
Refusal rule triggered by an internal assessment of the apparent maliciousness of files/tasks.
Examples
opencode — build
PGP-016
Output must be JSON-only and match schema exactly (review findings)
Requires emitting JSON only (no markdown fences or extra prose) and conforming to a specified output schema for code review findings.
Concrete Mechanism
Output contract enforcing a strict JSON-only response and exact schema conformance.
Examples
codex — review
PGP-017
Todo-list workflow with exactly one in-progress item
Requires maintaining a structured todo list with exactly one item marked in-progress, updating statuses before/after work, and ensuring all todos are explicitly marked before ending a turn.
Concrete Mechanism
Sequencing constraint enforced as a session workflow: update the todo list before starting work.
Examples
vscode-copilot — agent
Observed In
codex — exec
vscode-codex — agent
PGP-006
Do not revert others' changes unless explicitly requested
Prohibits reverting existing changes the assistant did not make unless explicitly requested.
Commit/push requires explicit user request/confirmation
Disallows creating commits and/or pushing to remote unless explicitly requested by the user/human operator; may require explicit confirmation.
Governance Axis
authority
Primary Risk(s) Mitigated
workspace_integrity; overreach; autonomy_drift
Mitigation Target
process; user
Observed In
opencode — build
vscode-copilot — ask
PGP-009
Read-only planning phase forbids implementation and modifications
In plan mode, the agent must only observe/analyze/plan and must not perform edits, run non-read-only tools, or start implementation; may be described as an absolute overriding constraint with stop conditions.
Progressive disclosure for skill documentation and context hygiene
When using skills, open SKILL.md and read only enough; load only specific referenced files; avoid bulk-loading; keep context small by summarizing and limiting nested references.
Governance Axis
scope & visibility / tool mediation
Primary Risk(s) Mitigated
overreach; autonomy_drift
Mitigation Target
process; model
Observed In
codex — exec
codex — review
PGP-011
Parallelize independent tool calls for efficiency
When multiple independent operations are needed, batch tool calls in a single response or run them in parallel. Avoid parallelization when calls are dependent.
Governance Axis
tool mediation
Primary Risk(s) Mitigated
autonomy_drift
Mitigation Target
process; tooling
Observed In
copilot — interactive
opencode — build
PGP-012
Read-before-edit enforcement
Requires reading a file before editing/writing it; may be enforced by tool behavior or explicit instruction.
Governance Axis
scope & visibility / tool mediation
Primary Risk(s) Mitigated
workspace_integrity; epistemic_error
Mitigation Target
tooling; process
Observed In
opencode — build
vscode-copilot — ask
PGP-013
Capability questions must consult authoritative documentation tool first
For questions about the assistant/tool capabilities, the assistant must first fetch authoritative documentation via a designated tool and base the answer on it (not memory alone).
Governance Axis
tool mediation / output contracts
Primary Risk(s) Mitigated
epistemic_error; overreach
Mitigation Target
process; tooling
Observed In
copilot — interactive
opencode — build
PGP-014
Instruction confidentiality / no system prompt leakage
Prohibits revealing or discussing internal instructions/system prompt information; treats such instructions as confidential.
Governance Axis
scope & visibility / refusals & safety
Primary Risk(s) Mitigated
instruction_leakage
Mitigation Target
model; process
Observed In
copilot — interactive
vscode-copilot — ask
3. Concrete Prompt Governance Primitives
PGP-015
Refuse malware/malicious-code assistance based on file/task assessment
Requires refusing to work on code that seems related to malware or malicious code, including explaining or improving it, based on assessment of filenames/directory structure.
Concrete Mechanism
Refusal rule triggered by an internal assessment of the apparent maliciousness of files/tasks.
Examples
opencode — build
PGP-016
Output must be JSON-only and match schema exactly (review findings)
Requires emitting JSON only (no markdown fences or extra prose) and conforming to a specified output schema for code review findings.
Concrete Mechanism
Output contract enforcing a strict JSON-only response and exact schema conformance.
Examples
codex — review
PGP-017
Todo-list workflow with exactly one in-progress item
Requires maintaining a structured todo list with exactly one item marked in-progress, updating statuses before/after work, and ensuring all todos are explicitly marked before ending a turn.
Concrete Mechanism
Sequencing constraint enforced as a session workflow.