Your AI Loops Need a Constitution, Not a Color Code

There's a popular playbook going around: 25 agent workflows, each tagged green, yellow, or red. Green runs alone. Yellow drafts, you approve. Red never touches money, production, or customers without a human.

It's good advice. It's also a confession.

Twenty-five copies of the same constitution

Every one of those prompts hand-writes the same rules: a budget cap, a stop condition, a state file, a human gate. Twenty-five workflows, twenty-five copies of the same constitution — written in prose, enforced by hope. Change one prompt and the rule quietly disappears. Nobody notices until the bill arrives, or worse, until an agent emails a customer something it shouldn't have.

I've spent thirty years building systems for organizations where "trust me, the prompt says so" was never going to pass an audit. Here's what I've learned: rules that live inside prompts aren't governance. They're suggestions.

Rules that live outside the agent

Governance is when the rules live outside the agent — in a signed policy file the runtime actually enforces. A budget cap that halts execution, not one the model promises to respect. A verification step that gates the "done" signal, so an agent can't declare victory without proof. An approval gate that blocks outbound messages at the code level, not the vibes level.

That's what we built with ClawMaven and Agent Bob. The color code becomes a loop_policy: hard iteration caps, stall detection, budget bounds. The "paste the proof" rule becomes a verification_policy: an independent checker that must pass before success counts. The whole thing gets sealed in a cryptographically signed manifest — so if anyone edits the policy, the tampering is detectable.

Prompts start it. Policy sustains it.

The loop library tells you what to automate. Governance decides whether you'll still trust the system in month three.

Prompts are where agent autonomy starts. Policy is where it survives.

Build a governed agent package in minutes at agent.ceobob.com — validated and signed by ClawMaven.