Plant a Rule You Want Your AI to Break

On catching AI drift early, and why the fix says more about you than about the model.

AI does not fail loudly. It fades. First it drops one small instruction. Then it makes a bolder assumption than you would have allowed. Then it is confidently wrong. By the time the error is visible in the work, the session has been drifting for a while, and the output you have to throw away is already written.

There is a clever answer to this going around. It is worth understanding, though not for the reason people share it. Deciding whether to use it forces a sharper question about your own setup than the trick itself ever asks.

The trick

Plant a rule you expect to fail first. Add one small, trivial instruction to the file that governs your AI, something easy to satisfy and easy to notice. "Begin every reply by addressing me by name" will do. While the model keeps doing it, your instructions are still being read. The first reply that forgets your name is your early warning that the rest of the rules, the ones that matter, are slipping too. Stop, and start fresh, before you trust the next answer.

It is named after the canary in the coal mine. The bird stops singing before the miners feel the gas.

The trick is not mine. It circulates among people who run these tools hard, and Matt Nunogawa has written it up well as part of a wider set of tactics for countering agent drift.

It is a good idea. I decided not to use it. The reason is the useful part.

Why I passed

I already run two defenses against this. I keep a working session short and start a clean one long before the context fills up. And I read every output as it lands. In plain terms, one control stops the problem from forming, and the other catches it in the work if it ever does.

The canary is a third kind of control. It does not stop the drift and it does not read the work. It plants a symptom and waits for it to fail. If you already prevent the problem and audit the output yourself, a third alarm tells you nothing new, and this one has a cost: it leaves a fingerprint on every reply, which is the last thing I want on a clause I am about to send or a memo I am about to sign.

So for me it is redundant. That is not a verdict on the trick. It is a statement about how I work.

It is really a mirror

Whether the canary is worth it depends entirely on how far your AI runs without your eyes on it. There are three places to stand.

Stand one: you keep sessions short and you read the output. You are the canary. The planted one is noise.

Stand two: you let the AI run long and compact its own memory, and you skim rather than read. Now the canary earns its keep, because it catches the two things you are not watching for: attention thinning across a long session, and detail lost when the AI summarizes its own history to keep going.

Stand three: you hand work to agents that run unattended. Here the canary is not optional. But it comes with a catch worth sitting with. If nobody is reading the output, nobody sees the canary go quiet either. So in that world the canary cannot be a note to yourself. It has to be checked by a machine: a small automated guard that confirms the signal is present on every run and halts the work the moment it is missing. A heartbeat, not a reminder.

The three stands: the further your AI runs without your eyes on it, the more the canary earns its keep.

Read those three back and the real finding appears. The canary is a mirror. Where you stand is a readout of how much of your thinking you have actually handed over, and whether the controls you lean on prevent failure or only flag it after the fact. Most people have never put that question to themselves. The trick is just the thing that makes them ask.

Two honest limits

It proves only that the canary survived. A rule sitting in a safe position can hold while the rules that carry real cost quietly rot, which is a false all-clear. Place it next to what you are most afraid to lose, not at the top where everything is already fine.

And it catches one failure, an instruction silently dropped. It says nothing about a confident invention on a fact your rules never covered. That is a different problem with a different fix.

The lesson under it

The better you watch the work yourself, the less machinery you need. The moment you stop watching, you need that machinery badly, and it has to be built, not hoped for. The line between what you keep your hands on and what you let run unattended is the whole game as this kind of work scales. It is the subject of Context by Design, my longer guide on designing context for AI work, and this small decision, whether to plant a rule you want your AI to break, is a clean way into it.