Project instruction files influence how a coding agent approaches a task, but they are not enforcement. Enforcement requires an objective check whose result does not depend on whether the model noticed, interpreted or followed the instruction.
Guidance and proof are different outputs
An instruction can tell an agent to preserve an API, avoid a directory or run a test. It improves the likelihood of compliant work. It does not establish that the final diff preserved the API, avoided the directory or passed the test.
Anthropic's documentation makes this distinction directly: CLAUDE.md is treated as context, while a hook can block an action. The general principle applies across agents even when the specific control mechanism differs.
Classify what can be checked
Some decisions have objective evidence: a banned dependency is absent, an endpoint remains present, a schema field still exists, or changed files stay inside an allowed boundary. Other decisions require human judgement, such as whether a user flow remains understandable.
Do not claim equivalent enforcement for both. Attach deterministic checks to the first group and clearly label the second as guidance requiring review.
Keep the decision beside the check
A policy check without rationale becomes mysterious build machinery. A decision without a linked check becomes easy to overstate. Relate the accepted record, its classification and the implementation of the check so reviewers can see what is proved and why it matters.
Use a layered control
Tell the agent about the decision before it edits, retrieve the complete record when the task touches the relevant domain, and run the objective check on the resulting change. Human review remains responsible for judgement-based constraints and for approving changes to the decision itself.