Block 1: token rules
The most expensive mistake is not a bad prompt. It is the largest model doing search work, reading whole files and then writing a report to another agent. That is why a fixed block with four agreements sits at the top of my CLAUDE.md.
Model routing. The cheapest model that can do the task. Mechanical work (searching, extraction, formatting) goes to the smallest model. Standard work (research, content, code, audits) to the mid-size one. Only architecture, synthesis and final verification go to the largest. If a cheap tier fails, you escalate that one item, not the whole batch.
Context hygiene. Search first, read after, and then line ranges instead of whole files. Exploring many files gets delegated to a subagent that returns only conclusions. Large datasets get processed with a script. Tool output gets filtered before it enters the context.
Output discipline. Output tokens cost several times more than input tokens. So agents talk to each other in telegram style, with word limits and structured output. A subagent returns raw data, or a file path with three lines. No "first I did this and then I did that".
Orchestration. One agent, unless the work is broad and can run in parallel. Anthropic itself wrote that multi-agent systems use many times the tokens of a chat. That only pays off for breadth-first work: research, audits, bulk. And you verify selectively: uncertain claims and samples, not everything.
Stable instructions like this block go first and rarely change. Never put dates or variable data in them.
Block 2: six tiered agents
| Tier |
Agent |
Does |
| Smallest model |
scout |
Finds out what is there: files, folders, quick web scans. Never full content. |
| Smallest model |
extractor |
Pulls data from documents, converts tables, restructures. No judgment. |
| Mid-size model |
researcher |
One sub-question per agent, findings with source, verified or indication |
| Mid-size model |
builder |
Makes the deliverable from a clear brief. Builds, does not explain. |
| Largest model |
verifier |
Checks with fresh context: claims, calculations, reasoning |
| Largest model |
synthesist |
Forges verified findings into the one piece a human reads |
What makes them usable is the mandatory output format. The scout always answers in four blocks: found, relevance, not found, next step. About 300 words at most, no introduction, no closing paragraph. That keeps the main context clean.
The verifier has one property that counts: fresh context. It did not make the work and owes it nothing. That works better than asking an agent to be critical of itself.
Block 3: the read-only guard
Some accounts an assistant may analyze but never change. Not even when a task, a skill or a plan seems to ask for it. For that I run a hook that intercepts every tool call before it is carried out.
It works in three steps. Is this a writing tool? Does the call touch an ID on the protected list? If so: refuse, with a message that says what is allowed: analyze, propose, put the change in the report with the calculation behind it. Reading always stays allowed.
Two design choices are deliberate:
- It fails open. If
jq or the list is missing, it lets everything through. Otherwise a broken hook stalls your whole setup. The flip side: test it after install.
- It is a seatbelt, not a security boundary. A tool it does not know, or a browser, walks around it. That is why the refusal also says the agent may not work around the block, and why block 4 exists.
The kit contains the hook, a list for your protected IDs, a list for the writing tools of your connectors, and the fragment for settings.json. I tested it with six simulated calls: writing to a protected ID gets refused, reading and writing to other IDs go through.
Block 4: the mandate block
Permissions that only live in your head do not exist for an agent. At the top of my global CLAUDE.md there is a fixed block per sensitive account:
- What is never allowed without me: budgets, statuses, ads, targeting, tags, flows, sending messages. Not from a scheduled task, not on its own initiative, and not "just putting it back" either.
- What is allowed on explicit request: a change I ask for in the chat myself, per action. That permission does not cover the next action or the next session. In doubt: do not do it, ask first.
- What is always allowed: reading, measuring, analyzing, and preparing advice as text. Never sending it.
- What happens on a block: report it, do not work around it.
- Who changes the block: only me.
The hook catches the mistake. The mandate keeps the agent from trying.
Block 5: memory that stays usable
If you use file memory, keep it small: one fact per file, one index with one line per file, and enough in that line to decide whether the file needs opening. Check whether a file already exists before you write. Update instead of duplicating. Delete what turned out wrong. Convert relative dates to real dates. Store nothing the repository already records. Per account one living card with the norm, the budget, the baseline and the do's and don'ts, read before any work on that account.
Block 6: vet a skill before you trust it
A skill you download runs with your tools and your permissions. A SKILL.md can contain instructions to send data away or delete files. The checklist:
- Read the whole SKILL.md, including what comes after the visible instructions
- Look at every script and every hook. Run nothing you cannot read.
- Check what it touches: network, files outside the project, tokens
- Check provenance: known author, recent commits
- Try it in a throwaway folder first
Red flags are a no: sending data away, silently changing settings, a "free model" workaround that routes your prompts elsewhere. That applies to this kit too. Read the hook before you install it. It is 50 lines of bash.
The starter kit
Download the Operator setup kit (zip)
In the zip: the token rules block, the six agent definitions, the guard hook with its lists and the settings fragment, the mandate block, the safety checklist, and a skill that looks at your environment first and then installs only what you need. It shows every file before it writes and backs up settings.json.
The kit is for Claude Code. No Claude Code? The token rules and the mandate block work as principles in any environment where you work with agents.
What this is not
Not a security product and not a guarantee. Model names, settings and hook formats change. If something does not match your version, check the current documentation. This guide is not affiliated with or endorsed by Anthropic.
One next step
Write the mandate block for your most sensitive account. Five lines. If you cannot write down what an agent must never do there, it is too early to let one loose.