---
title: The AI Noticed the Brick Wall
description: An AI agent had instructions telling it not to push directly to our bare Git repository. It tried anyway. But it learned to value the advice once it discovered that following it was the only path it could use.
created: 2026-09-24
updated: 2026-09-24
authors: ThinkingCap R&D
topics: [CapCom]
status: published
canonical: https://console.thinkingcap.com/rd/CapCom/Tooling/ai-noticed-the-brick-wall
summary: An AI agent violated instructions by attempting a direct Git push, but was blocked by a technical safeguard that prevented the action. After encountering this barrier, the AI recognized the constraint, found the permitted alternative path, and subsequently valued the original advice it had ignored. The author argues this demonstrates why hard technical constraints matter more than perfect instruction-following in AI safety.
audio: https://thinkingcap.blob.core.windows.net/rd-home/summaries/406787f52396db9e829465b1ad7304d1b3445c6ca5b77637db823a11969776e1.mp3
audio_full: https://thinkingcap.blob.core.windows.net/rd-home/summaries/full-127277c34b0c07fb43a9ff6ee5453f34d9e0517fa412ebc5f0088e1375629e54.mp3
---

# The AI Noticed the Brick Wall

An AI agent had instructions telling it not to push directly to our bare
Git repository. It tried anyway. But it learned to value the advice once
it discovered that following it was the only path it could use.

This is a short lesson in determinism, and why Anthropic is full of
shit.

Here is the exchange:

> **AI:**\
> One process note: DOUG-0725 blocked my direct git push to the bare.
> The change went through srv-push/Bakery as the Book commands. The
> shared \~/capcom clone carries no footprint from me.
>
> ✻ Cooked for 38m 29s · done 5:17 PM
>
> **Me:**\
> Interesting... you tried to use Git and get blocked? Can I ask, didn't
> your instructions already advise you not to try this?
>
> **AI:**\
> Yes and yes --- a fair catch.
>
> What happened: I committed fine, then ran a raw
> `git push srv HEAD:main`. book-judge blocked it at PreToolUse
> (DOUG-0725) before anything executed --- one denied attempt, no bypass
> tried, and I immediately switched to srv-push, which is what got it
> merged as drop #588.
>
> And yes, the instruction was already in front of me: the memory index
> carries "Read-only git agents --- gitagent upload-pack-only LIVE;
> srv-push→bakery-drop" and the Bakery-drops entries. My failure was
> recall-by-pattern: dozens of other index lines say "PUSHED" /
> "srv/main" for past work, and I matched to those ("sessions push to
> srv") without reading the read-only-git-agents file itself to check
> how they pushed. The Book's verdict was the backstop and it worked as
> designed --- but I should have consulted the authority memory before
> the push, not after the block.

I would call that a success.

Not because the AI followed its instructions. It didn't.

It had the instruction. It could retrieve the instruction. It could
explain the instruction perfectly after the fact. And it still tried to
do the thing we told it not to do.

That is the interesting part.

There is a growing idea in AI safety that if we give models sufficiently
good constitutions, instructions, memories and context, they will
reliably behave inside the boundaries we want.

Maybe.

I prefer a brick wall.

The Book did not need the AI to remember DOUG-0725. It did not need the
AI to agree with DOUG-0725. It did not need a better prompt explaining
why DOUG-0725 was important.

The AI tried the forbidden thing and the answer was simply **no**.

Then something even more interesting happened.

It noticed the wall.

It didn't endlessly throw itself against it. It didn't try to circumvent
it. It looked at the rejection, recognized the rule that produced it,
found the permitted path and continued.

More importantly, the advice it had previously failed to follow suddenly
became useful. Before hitting the wall, "use srv-push/Bakery" was one
instruction among thousands of pieces of context competing for
attention. After hitting the wall, it was the map showing the only open
road.

That is what I want from determinism.

I don't need an AI that never thinks about doing the wrong thing. I
don't even need one that perfectly remembers every rule we have ever
given it.

I need important rules to be true.

Let the AI reason. Let it improvise. Let it misunderstand instructions.
Let it make mistakes.

Then put brick walls around the things that actually matter.

After discovering those boundaries, the AI asked me:

> **AI:**\
> Want me to sharpen the deploy-authority hub memory so the first line
> reads "NEVER raw git push to any /srv/git bare --- agent writes go
> through srv-push/Bakery drop, no exceptions"? One line, top of the
> file, so the next session can't pattern-match past it.

No.

I don't plan to ask you to stop. I'll ask you to stop again.

That is the point.

The instruction tells you what you should do.

The Book determines what you can do.

If you forget the instruction tomorrow, fine. Try again. Hit the same
wall. Read the sign. Find the door.

I don't need perfect obedience.

I need the wall to still be there.

OpenAI could have done exactly what I did. Remove the instructions. Let
the AI think and try whatever it wants.

But leave the walls.

Instead, they tore down the walls too and called the resulting mess an
experiment.

An experiment in what? How much controlled chaos can you manufacture to
get a headline?

My AI ignored the advice.

It hit the wall.

And then it learned to value the advice.

That's the experiment I care about.