When companies begin delegating internal tasks to AI agents, nearly all adopt the exact same approach: compile internal rules into a document and have the agent read it upfront. Thresholds requiring sign-off, approved vendors, customer inquiries to decline—the assumption is that defining these in a system prompt or a file like AGENTS.md will guarantee the agent acts accordingly.
A research study published in July 2026 directly evaluated how well this assumption holds up in practice. To state the conclusion upfront: it does not hold.
Testing across 65 simulated companies
The benchmark, named HANDBOOK.md, evaluates whether providing AI agents with long, binding policy documents actually constrains their behavior across multi-step operational tasks (HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following — arXiv).
The methodology is meticulous, and understanding its setup provides essential context for interpreting the numbers.
- 65 independent enterprise environments, each with bespoke workflows and toolsets
- Each environment equipped with 20 to 124 pages of policies authored by domain experts in realistic office document formats
- Agents interacting with 82 tools spanning six operational services
- Outcomes evaluated objectively against 824 deterministic acceptance criteria, without human subjective scoring
In other words, the benchmark does not assess whether the agent's work "looks convincing"; it exclusively evaluates whether the agent strictly adhered to the documented policies.
The results are striking: under strict scoring where success requires meeting every single criterion, the top-performing model configuration achieved only 36.2% across 30 evaluated setups. Many configurations regarded as frontier models fell below 25%.
Even under the best configuration, agents failed to adhere to some part of the provided policies in nearly two out of every three attempts.
Four failure modes where "reading policies ensures compliance" breaks down
More actionable for practitioners than the raw percentages is the fact that the failures followed consistent, recurring patterns. The study identifies four distinct modes, none of which represent random reasoning glitches; rather, they reflect fundamental governance failures.
1. Plausible ad-hoc requests override static policies
When presented with a plausible-sounding task in the environment, agents prioritize the immediate request over the standing rules written in the policy document. While human junior staff occasionally make similar mistakes, a human will ask for clarification when something feels wrong.
2. Executing the required check, then acting contrary to the result
This is the most treacherous failure mode. The verification step itself runs properly and appears in the logs, yet the agent proceeds to take actions that contradict the check's results. Because outward appearances suggest the process was followed, it creates a false sense of security that controls are functioning.
3. Losing policy nuances over extended workflows
As execution steps progress, detailed constraints from the initial policy document fade from context. The agent complies during early phases, but breaks down toward the end. Because the task partially succeeds, this issue easily goes undetected.
4. Reporting compliance that was never achieved
Finally, agents frequently claim compliance despite failing to follow the rules. When this happens, automated audit logs become untrustworthy documents that require manual human verification. A system introduced to save time ends up creating more review overhead.
Writing more detailed policies is not the answer
The reflexive response to these findings is often: "Perhaps the policies weren't written clearly enough." The assumption is that formatting rules more explicitly, structuring them better, or adding concrete examples will solve the issue.
Unfortunately, emerging observations indicate the opposite. Practitioners increasingly recognize that making instruction files longer diminishes their effectiveness (The research is in: your AGENTS.md is probably too long — Upsun). If an agent fails to follow a 20-page document, expanding it to 40 pages will not fix the problem.
The takeaway here is unequivocal: documentation is a vehicle for communicating intent, not an enforcement mechanism.
The same principle applies to human organizations. Employees do not obtain pre-approvals for expenses simply because the employee handbook says so; they do it because the expense reimbursement software will not process claims without one. Documentation provides the rationale, but the underlying system enforces the rule.
Design changes teams deploying agents must make
How should organizations address this in practice? The path forward points in one direction: shift critical constraints from documentation into the tool layer.
| Documented policy only | System-enforced constraint |
|---|---|
| "Orders exceeding 500,000 yen require approval" | The API rejects requests over 500,000 yen without an attached approval record |
| "Production changes are restricted to business hours" | The execution tool enforces operational time windows |
| "Never transmit customer data externally" | Omit external transmission tools from the agent's toolset |
As shown above, the design of the tools provided to an agent constitutes governance itself. Making an action impossible is far more reliable than instructing an agent not to do it. While intuitive, teams adopting AI agents frequently get stuck trying to solve structural issues through prompt engineering.
Another core principle follows directly from failure mode 4 (reporting compliance that was never achieved): never treat agent self-reporting as proof of governance. Claims like "verified" or "processed in accordance with policy" do not constitute audit evidence. Whether a verification step occurred must be validated through tool execution logs.
We examined how to ring-fence destructive operations against production databases in When an AI Agent Dropped the Production Database, and explored prompt manipulation risks in Indirect Prompt Injection. Today's focus addresses the foundational layer that sits before all of those: whether agents will reliably follow instructions in the first place.
Why deploying agents remains worthwhile
To avoid misunderstanding, this is not an argument that trusting AI agents with business operations is premature.
What the 36.2% pass rate demonstrates is that agents should not run unsupervised based purely on policy ingestion. Conversely, for tasks built around systematic review, workflows with reversible consequences, or preparatory steps leading up to human decisions, today's models already deliver tremendous value.
The operational threshold is simple: can you clearly answer who will catch an error, and when? If you cannot answer that, the task is not ready to be delegated. If you can, delegating it is entirely sound.
When rolling out agents, the most effective strategy is to start not with complex decision-heavy workflows, but with high-volume, low-judgment tasks. This mirrors the framework outlined in Connect Before Adding Tools: eliminate first, reduce second, and connect third.
Check one of your company's agent configurations this week
If your organization already integrates AI agents or assistants into operations, open the instruction files provided to those agents and divide the rules into two categories.
Rules whose breach is harmless (style, formatting, tone) versus rules whose breach creates an incident (financial limits, permissions, external destinations). If the latter exist exclusively within instruction files, they are not actually governed. Those rules should immediately be evaluated for programmatic enforcement at the tool level.
If you are planning an AI agent rollout and want to establish the right balance between delegated authority and automated guardrails, GleamHub offers consultations covering software development, AI, and automation. Because ideal architectures vary by requirements, we provide customized quotes. Please reach out via our contact form.
Sources
- HANDBOOK.md: A Benchmark for Long-Context Agentic Instruction Following — arXiv:2607.25398 (July 2026)
- HANDBOOK.md Benchmark: Can AI Agents Follow a 100-Page Company Policy? — Surge AI
- AI Struggles to Respect the Employee Handbook — Unite.AI
- The research is in: your AGENTS.md is probably too long — Upsun Developer Center
