Agree the rules before the mess.
Once several people are using agents on shared code, you need shared rules. Keep them short, and keep them where the work happens.
Five Team Rules
Review
Every AI change reviewed by a human
Tests
New behaviour comes with tests
Context
Each repo has a shared CLAUDE.md
Data
No customer data in prompts
Tools
Only approved tools and accounts
Where rules should live
In CLAUDE.md, so the agent follows them.
In the pull request template, as a checklist.
In CI, so tests and checks are enforced.
Not only in a PDF on the intranet.
Rules in the repo beat rules in a PDF.