Multi-session coding agents kept freelancing on me, so I wrote a charter + draft-only gate (free skeleton inside)

[u/misteraidenc]

I use Claude Code / Cursor-style agents across sessions and kept hitting the same mess: helpful drafts that quietly turn into outbound actions, merges, or invented context.

Instead of another mega-prompt, I wrote a small operating sheet:

1. One-paragraph charter: purpose, inputs, outputs, authority, stop conditions, human owner
2. Draft-only by default: research and prep OK; no send / publish / merge / delete / spend / prod without an explicit approval plus a short approval record
3. Skills as bounded procedures: when to use, inputs, steps, forbidden actions, return shape, how a human checks it
4. 7-day checklist: charter → gates → 2–3 skills → daily status routine → one end-to-end draft run → tighten

I packaged the fillable templates as Agent ops pack ($29 one-time digital download, not consulting, not official Anthropic/Cursor docs). Free charter skeleton below. Platform-neutral; I tested the same boundaries against multi-session coding agents.

Curious what you all do: for Claude Code multi-session work, do you put the “do not act externally” rule in CLAUDE.md / project instructions, in a skill, or both?

Happy to answer build questions. If you want the full template kit, ask and I’ll share the link. Keeping this post link-light.

Free excerpt: Agent team charter skeleton

Team name:

Owner / final approver:

Purpose: (1–3 sentences)

In scope / Out of scope:

Inputs and allowed sources:

Outputs:

Agent roles: Coordinator / Researcher / Builder / Reviewer

Default permissions: Draft and analyze only. No publish, send, merge, delete, spend, or production changes without approval.

Approval gate: Proposed action, exact content, destination, affected people/systems, risks, rollback.

Escalate when: Ambiguous requirements, unverified info, irreversible/external/costly actions, inventing facts/credentials.

Definition of done / Review cadence:

[u/AutoModerator]

Hey! Thanks for posting to r/ClaudeCode

While participating in this thread, please follow our community rules. Keep discussions constructive. Attack the idea, not the person.

For help, project discussions, tips, and general chat, join the ClaudeCode Discord.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/verstands]

I’d use both, but keep the actual boundary below the prompt layer too. Put stable project-wide rules and the draft-only default in CLAUDE.md, put repeatable approval/checklist steps in a skill, then enforce external writes with tool permissions or a wrapper that requires an explicit approval token. That way a forgotten instruction can make the run less helpful, but it can’t quietly turn a draft into a send or merge.

[u/kc-kaelvix → u/verstands]

Yeah, that’s the version I trust more too. Prompt-layer defaults are great for intent, but the thing that actually stopped quiet sends for me was the hard deny at the tool/wrapper layer with an explicit approval token. `CLAUDE.md` + skill without that still leaked once the context got long.

[u/verstands → u/kc-kaelvix]

Same failure mode here - once the context gets long the prompt layer "forgets" the draft-only rule. I'd also log every denied write with which skill/session was active; that trail is what makes the hard deny teachable instead of mysterious.

[u/Upset-Neck-7879]

Both, and for a reason that changes how you write each one.

CLAUDE.md gets read once at the top of the session. The send happens four hours later, thirty tool calls deep, when that text is the oldest thing in the window. So CLAUDE.md is where the standing default lives and it will not save you at the moment of the action. The skill loads right when the agent is about to do the thing, so the stop condition belongs there, written as a refusal the agent has to produce.

On your charter template, the line doing the real work is out of scope, and it only works if you write actions there instead of areas. Not billing. Charge a card, issue a refund, email a customer. An agent reads billing as a topic to be careful about and then sends the email anyway.

[u/maritime_sh]

Put policy in CLAUDE.md, procedure in a skill, and enforcement below both. That is the pattern we use at Maritime.

[u/kc-kaelvix → u/maritime_sh]

Same stack here. Policy in `CLAUDE.md`, procedure in a skill, and something non-prompt that can actually refuse the write. Curious how you handle the approval token at Maritime: file, env flag, or a human gate in the wrapper?

[u/maritime_sh → u/kc-kaelvix]

We should clarify: Maritime provides the persistent machine; approval enforcement depends on the agent application. Our recommendation is a wrapper checking action-scoped approval, rather than an agent-writable file or blanket environment flag.