Curtailing The Chaos

How To Set Your Org Up For AI Success

"Individual productivity becomes organizational debt" was the diagnosis in "The Proliferation Problem": every team standing up its own AI tooling in isolation, one uncoordinated IDE extension and one rogue subscription at a time, compounding into a liability nobody signed off on. Diagnosing the fragmentation was the easy part. The harder question is what you actually do about it that isn't "ban everything" — because blocking AI tooling doesn't eliminate the shadow usage, it just moves it somewhere security can't see it, trading a visible governance problem for an invisible one.

The instinct in security and platform teams facing this is to become the department of no: block extensions, require a ticket for every model access request, centralize approval behind a review board. That instinct is understandable and it fails for a structural reason, not a cultural one: a rule enforced by asking people to file a request and wait is advisory. It survives exactly as long as the friction of circumventing it exceeds the friction of complying with it, and for an engineer trying to ship, that math flips fast.

Instructions Are Infrastructure, Not Etiquette

The concrete lever available today is a repository-level instructions file, auto-loaded into every chat and coding-agent request against that repo — no extension configuration, no per-developer setup, picked up the same way a linter config is, by existing in the tree. GitHub Copilot's implementation is concrete enough to use as the reference: .github/copilot-instructions.md at the repo root, with a finer-grained layer underneath — path-scoped instruction files under .github/instructions/, each carrying an applyTo glob in its frontmatter, so a rule about a specific stack only enters the window when a matching file is actually in play. Other coding assistants converge on the same shape under their own filenames; the mechanism generalizes even where the path doesn't.

"The Context Gap" named the mechanic that makes this powerful and dangerous in the same breath: layers concatenate, they do not merge. An org-wide policy layer, a repo-level instructions file, and a path-scoped fragment all land in the same context window side by side. There is no precedence engine reconciling them. If your organizational baseline forbids something and a repo's local instructions file — written by someone in a hurry — quietly contradicts it, the model doesn't resolve that conflict. It picks one, non-deterministically, and you find out which one it picked when something ships wrong.

Architecture Rule: A global instruction baseline that nobody checks against local overrides is advisory text with an authoritative tone. Enforcement has to catch contradiction, not just absence.

Making the Baseline a Structural Fact, Not a Suggestion

The Context Gap's path-assertion pattern — a CI script that extracts every path reference from a context file and fails the build if one no longer resolves — extends cleanly here. A required status check, wired into branch protection at the organization level (GitHub calls it repository rulesets; other Git hosts enforce the same gate under their own name), can verify that the repo's instructions file — .github/copilot-instructions.md or whatever the org's chosen assistant reads — exists, hasn't silently diverged from a small set of non-negotiable clauses, and gets touched in the same pull request that changes a convention it documents. That check blocking merge is structural. A wiki page telling teams what the instructions file is supposed to contain is advisory, and it rots exactly the way every hand-maintained artifact in this series rots — quietly, until an audit finds it.

Identity Is the Guardrail That Doesn't Feel Like One

The tooling side of "rogue AI subscriptions" isn't a policy failure, it's a provisioning failure: the sanctioned tool takes a ticket and a wait, and the unsanctioned one is a personal card away. The fix isn't a stricter approval gate; it's making the sanctioned path the fast one. Conditional access tied to an identity provider — an Entra ID group membership that auto-grants a seat in the org's sanctioned coding assistant and a specific model allow-list the moment someone's added to an engineering team — turns "which AI tool am I allowed to use" from a question a human answers per request into a fact the directory already encodes. It's the same structural-versus-advisory distinction, aimed at people instead of agents: a permission system that never handed someone the unsanctioned tool beats a policy telling them not to use it.

Self-service provisioning through identity is also what keeps this from becoming the department of no. Nobody has to ask permission for something already granted to their group. The review board's actual job shrinks to the exceptions — a request for a model or extension outside the standard allow-list — a queue small enough to move fast, instead of a bottleneck absorbing every routine request an engineering org generates in a week.

What Standardizing the Instruction Layer Doesn't Buy You

None of this touches what the tooling actually produces. A repo with a pristine instructions file, a branch-protection rule enforcing it, and a directory-driven provisioning flow can still ship code nobody would trust in production — the instructions file governs what the model is told to consider, not whether what it generates actually holds up once it leaves the editor. Standardizing access and instructions is the precondition for a coordinated organization; it says nothing yet about whether the commits that access produces are safe to merge.

I'm walking through the concrete configuration for both layers above — repo-level AI instruction files and the branch-protection rules enforcing them across a real development team — live, in a 90-minute session at The Cloud & AI Summit 2026.

Further Reading

• GitHub's documentation on custom instructions for Copilot. The concrete reference implementation for the repository-wide and path-scoped instruction files this post describes — most other coding assistants implement the same pattern under a different filename.
• GitHub repository rulesets and required status checks. The mechanism this post points to for turning a documented convention into a merge-blocking gate rather than an advisory one; other Git hosting platforms enforce the same gate under their own branch-protection model.
• Conditional access policies in Microsoft Entra ID. The identity-driven provisioning pattern referenced above for turning tool access into a directory fact instead of a manual approval queue.