Where do you start?
With a real workflow from the team, not with the licence. I would pick a task that comes up often and is easy to check, for example the path from a story to a pull request. In my day job I worked on such a workflow with AI. My own agent setup, on the other hand, I run alone. Where I draw conclusions for teams below, that is my assessment, not experience from a rollout.
Where do the rules live?
In one file in the repository that every tool reads. For me that is an AGENTS.md, with CLAUDE.md as a symlink to it. It holds the build and test commands, decisions you cannot see in the code and what an agent must not touch. When several people use different tools on the same project, one shared source matters more than perfect wording. Lines like “write clean code” can go.
Is a rule in the prompt enough?
Not for the important ones. I counted how often agents in my setup follow a plain hint, and it was too rarely. A block with a reason, on the other hand, they followed. So I turn hard rules into hooks: the hook checks a command before it runs and rejects, say, a force-push. The reason tells the agent what is allowed instead. For a team, I take this to mean that anything that must never happen belongs in hooks or in the agent’s permissions, not only in the instruction file.
Who checks what the agent writes?
In my setup, two models from different vendors review every commit before it lands on main. If one blocks, the commit stays local and gets fixed. I do not rely on that review to find bugs reliably, though. In a team I would treat it as an extra voice; tests and a person who owns the change are still needed. Also, the agent that writes the code is not allowed to commit or merge itself. A separate agent handles Git.
How do you keep costs in view?
With limits outside the model. My daily budgets for paid calls live in the broker that distributes tasks, and an agent cannot lift them through a prompt. Subscription quota is used first, pay-per-use APIs only when nothing else is available. It started with a week where my spend proxy (an approximation of spend, not an invoice total) was several times the week before. Since then a stricter rule kicks in automatically when my weekly quota runs low. For a team, I would settle beforehand who has which budget and what happens when it runs out.
What must an agent not do without a person?
For me that means production deployments, deleting data outside Git history and anything that costs more than the budget allows. An agent may read mail. Sending, replying or deleting only happens once I have approved that exact message. Which list fits a team is for the team to decide. What matters to me is that it is written down and, where possible, enforced technically before the first agent with write access runs.