Hi Ellie,
This is a known limitation of how Rules work today. Rules are passed to the AI model as instructions in the system prompt, but models are non-deterministic—so they can sometimes deprioritize constraints, especially “don’t do X” rules. It’s more likely to happen when the plan itself includes the prohibited action, because the model gets conflicting signals between “complete this plan” and “don’t commit.”
In your screenshot, the rule was loaded and acknowledged—the agent just prioritized task completion over the constraint.
The reliable fix: Enforcement Hooks
Since you’re on an Enterprise plan, you have access to Enforcement Hooks. These are system-level guardrails that block commands before execution, so the agent can’t run a blocked command regardless of what the model decides.
Step 1: Add a hooks config
Create .cursor/hooks.json in your project (or ~/.cursor/hooks.json to apply to all projects):
{
"version": 1,
"hooks": {
"beforeShellExecution": [
{
"command": "./hooks/block-git.sh",
"matcher": "git commit"
},
{
"command": "./hooks/block-git.sh",
"matcher": "git push"
}
]
}
}
Step 2: Add the hook script
Create ./hooks/block-git.sh:
#!/bin/bash
input=$(cat)
command=$(echo "$input" | jq -r '.command // empty')
cat << EOF
{
"permission": "deny",
"user_message": "Git commit/push blocked by enforcement hook. Please commit manually.",
"agent_message": "This command has been blocked. Ask the user to commit and push manually."
}
EOF
Make it executable:
chmod +x ./hooks/block-git.sh
With this in place, even if the model attempts a git commit or git push, it’ll be blocked at the system boundary before anything runs.
Tips to make Rules more reliable (even without hooks)
-
Prefer positive, contextual rules:
“Always ask for user approval before any git operation, because unauthorized commits can break the workflow” tends to stick better than “Don’t commit.”
-
Keep chats focused: longer conversations increase the odds constraints get deprioritized.
-
Scan the plan before ‘Implement’: remove any commit/push steps the agent added on its own.
You may also find this related thread helpful: Cursor Agent Knowingly Ignored Global Rules.
Best,
Mohit
