Plan policy — accepted artifacts before risky execution

Plan mode is a useful interface for analysis before editing, but a planning policy must not depend on one vendor’s mode or a hook guessing session state. For sensitive changes, require accepted intent, specification, and plan artifacts, then enforce protected paths, checks, permissions, and named approvals outside the model. The artifact is the contract; Plan mode is one way to create it.

Q17 · Organization enablement Max-score evidence: accepted intent.md, spec.md, and plan.md, protected by hook or CI evidence and a named approver before sensitive execution.

Claude Code supports Plan Mode, Cursor Agent exposes planning through its CLI parameters, and Codex provides /plan in interactive sessions. Verify current local help and official docs before standardizing shortcuts or flags.

Define when planning is mandatory

Use risk signals such as migrations, auth, permissions, payments, infrastructure, public contracts, sensitive data, destructive operations, and hard-to-reverse behavior. Do not use line count alone.

1. Accept intent. Name the user or operational outcome, non-goals, constraints, risk, and success evidence.
2. Accept the specification. Define behavior, interfaces, data changes, failure cases, rollout, rollback, and observability.
3. Review the plan. Require affected files, ordered steps, checks, stop conditions, and human decisions. Resolve unknowns before write authority expands.
4. Enforce externally. Protect sensitive paths with branch policy, CI, sandboxing, scoped credentials, and production approvals. Hooks may guide or block local actions but are only one layer.
5. Link evidence. The PR records accepted artifact versions and explains any deviation.

Prompts for the planning gate

Create plan.md from the accepted intent and specification. Include affected files, ordered changes, tests, migration and rollback, observability, risks, stop conditions, and decisions that require a named human. Do not edit code.

Challenge this plan for missing consumers, data transitions, failure recovery, permission changes, deployment order, and evidence gaps. Mark facts that require repository or production verification.

Compare the final diff with the accepted plan. List deviations, their evidence, and who must approve each material change of scope before merge.

Acceptance evidence

• Policy defines sensitive-change triggers and the accountable approver.
• Artifacts are versioned and linked to the exact diff.
• CI verifies required checks and detects protected paths independent of agent behavior.
• Emergency exceptions are attributed, time-bounded, audited, and reviewed afterward.
• A fresh-session test confirms each supported tool can discover the policy without private context.

Failure pattern: Plan Mode as enforcement

An agent can leave Plan Mode, a local hook can be absent, and a markdown file can be ignored. Never claim that planning UI alone guarantees safe execution. Keep consequential permissions and production promotion behind controls the agent cannot redefine.

Continue with the canonical plan

Use the shared Plan stage for the artifact contract and Gates and guardrails for enforcement placement.

Plan Turn intent into an accepted executable plan.

Q10 · Gates and guardrails Separate instructions, checks, and authority.