AI coding assistants read instruction files in your project. If you put these rules in one of those files, the assistant follows them while it writes code and can warn you before it breaks one.
This page shows you how to set that up for the common tools. If you don't use AI, you can skip it. The rules work the same way without it, as how to use these rules explains.
Two things to know first
- The AI can still get it wrong. It may miss a rule or say something passes when it doesn't. A person still goes through the checklist and signs off each release.
- Never paste secrets or personal data into an AI chat. That means passwords, API keys, or your users' details (rule 25Rule 25. Always. Never put passwords, keys or other secrets in your code or logs. Keep them in a secrets manager and use tokens that expire quickly.).
Step 1: Put a copy of the rules in your project
Save RULES.md into your project, for example as docs/humane-dev-rules.md. You can download it from GitHub, or run this in your project folder:
mkdir -p docs
curl -o docs/humane-dev-rules.md https://raw.githubusercontent.com/abuturab840/humane-dev-rules/main/RULES.md
Your copy won't update by itself. Check back here now and then for changes.
Step 2: Point your AI tool at it
Each tool reads a different file. Pick yours.
Claude Code
Create a file called CLAUDE.md in your project's main folder (or open it if it's already there) and add:
@docs/humane-dev-rules.md
The @ line tells Claude Code to read the rules file. To use the rules on every project on your computer, put the same line in ~/.claude/CLAUDE.md instead, with the full path to your copy.
Cursor
Create a file at .cursor/rules/humane-dev-rules.mdc with this at the top, then paste the rules underneath:
---
description: Humane Dev Rules
alwaysApply: true
---
GitHub Copilot
Create a file at .github/copilot-instructions.md and paste the rules into it. Copilot reads this file for chat and code suggestions in that repository.
Other tools
Many other assistants, including OpenAI's Codex, read a file called AGENTS.md in your project's main folder. Paste the rules in there. If your tool uses a different file, its documentation will say which.
Chat assistants (Claude, ChatGPT and others)
If you plan in a chat app rather than in your code editor, add the rules file to a project's files or knowledge, so every chat in that project can see it. Or paste the rules at the start of a new chat.
Step 3: Tell it how to use them
The rules alone aren't enough. Tell the assistant what to do with them. Paste this under the rules, in the same file:
How to use these rules:
- At the start of a new project or a big new feature, ask me the intake questions and tell me which "Only if" rules apply.
- If something I ask for would break a rule, tell me which rule and why, and ask me before you do it.
- Before a release, go through the release checklist. Mark each item pass, fail or n/a, with a short reason.
- Never put secrets in code or logs.
Prompts you can use
Copy these into your assistant when you need them:
- "Answer the intake questions for this project from the code. Ask me about anything you can't tell."
- "Fill in the project template (TEMPLATE.md) for this project from the code. Leave a question for anything you can't tell."
- "Do a 15-minute Consequence Scan of this feature with me. What could go wrong, and for whom?"
- "Check this sign-up and cancel flow against rules 9Rule 9. Always. Make leaving as easy as joining. Cancelling, saying no and deleting an account should take no more effort than signing up, saying yes or creating one., 10Rule 10. Always. Don't use dark patterns, the design tricks that push people into things they didn't mean to do, and don't use guilt-trip wording like "No thanks, I don't like saving money". Check your screens against the examples at deceptive.design. and 56Rule 56. Always. In every dark pattern review, ask the regret test question: would people regret using this feature if they understood how it works? If yes, remove it.. Point out anything that could be a dark pattern."
- "Check our cookie banner against rules 15Rule 15. Only if you have visitors from the EU or UK and use optional cookies or tracking tags: don't load anything optional until the visitor says yes., 16Rule 16. Only if you show a cookie banner: put "Reject all" and "Accept all" side by side on the first screen, looking exactly the same. and 19Rule 19. Only if you use optional cookies: put a cookie settings link in every footer, and remember each visitor's choice for six months.."
- "Review this change for security problems. Check permissions (rule 23Rule 23. Only if users log in: check on the server, every time, that the person is allowed to do what they're asking. When in doubt, the answer is no.), secrets (rule 25Rule 25. Always. Never put passwords, keys or other secrets in your code or logs. Keep them in a secrets manager and use tokens that expire quickly.) and dependencies (rule 28Rule 28. Always. Use as few outside packages and plugins as you can, pick well-maintained ones, and lock their versions in a lockfile.)."
- "Go through the release checklist for this release. Mark each item pass, fail or n/a, and explain any fail."
If you're adding AI to your own product
That's a different thing from using AI to write code. If your product has AI features, such as a chatbot or AI-written replies, section F of the rules applies. It covers labelling AI, treating its input as untrusted, limiting what it can do, and testing it before launch (rules 36aRule 36a. Only if users chat with AI or read replies it writes: show a small "AI" label, unless that's already obvious, for example on a "Generate with AI" button. to 42Rule 42. Only if you use AI: try hard to make it misbehave before launch and after any big change. This is called red-teaming.).