Ask HN: How do you guys stop coding agents from acting out of line?

I’ve been pretty annoyed recently with my coding agents doing stupid things that are anti-protocol. I can encode rules like “agents shouldn’t write to the README” pretty easily, but things like “database migrations must be autogenerated and not handwritten” are much harder to enforce. Anyone have any tools they use for this or tips for how to deal with issues like that?