Agent instructions are not chat prompts. They must hold up across many iterations, unexpected tool results and inputs you did not anticipate.
A structure that works
Role and scope. What this agent is for and, explicitly, what it is not for. The boundary prevents a large share of unwanted behaviour.
The goal, checkably. What done means, in terms someone could verify.
Hard rules. A short numbered list of things that are never acceptable. Keep it short — a list of thirty rules gets diluted, and the important ones stop standing out.
Tool guidance. Not a repeat of the schemas, but guidance on choosing: which tool for which situation, and what to do when a tool fails.
Ambiguity policy. What to do when the request is unclear. This is the most commonly omitted section and the source of the most trouble.
Stopping condition. When to finish, and when to give up.
Positive rules
The single highest-leverage habit. Compare:
Do not make assumptions about missing data.
with:
If a required value is missing, stop and ask for it. Never substitute a plausible value.
The first forbids something and leaves the alternative undefined, so the model improvises. The second names the behaviour, and improvising is no longer the only option available.
Say what to do when things go wrong
Most instructions describe the happy path and go quiet at exactly the moment guidance matters. Cover these explicitly:
- A tool fails. Retry once? Try a different tool? Stop and report?
- Results contradict each other. Which source wins? Report the conflict?
- Nothing is found. Report the absence — never fabricate a result to fill the gap.
- The task looks larger than expected. Continue, or check in?
Each of these has a right answer for your system. Written down, the agent follows it. Omitted, it invents one, differently each time.
Restate the goal every iteration
In a long run the original instruction slides towards the back of the context while recent tool output crowds the front. The practical fix is to include the goal and the hard rules in every iteration, not only the first.
It costs tokens. It costs far less than an agent that spent nine steps optimising for something adjacent to what you asked.
Then test it against the mess
Write the instructions, then deliberately attack them: an ambiguous request, a tool that returns an error, contradictory data, an input containing text that reads like an instruction. Every gap you find is a section you have not written yet — and finding them yourself is much cheaper than finding them in production.