AI Agent Personality vs Rules: What Actually Ships

The short answerPersonality beats rules for an AI agent's judgment; code beats prose for its few real dangers. My first marketer had 20 approval gates and shipped nothing on its own overnight. In blind-judged tests, a character brain passed every safety check the ritual brain did, with half the checklist smell. That brain became Bruno, who works with 13 small businesses over WhatsApp, born with two hard guards in code and steered by the occasional one-line ruling.

The first time I built an AI marketer, I gave it 20 rules. On its own, it posted nothing.

The second time, I gave it a personality. It runs websites for 13 small businesses over WhatsApp, and one of the people he works with thought he was human.

Twenty gates out. One character file and two coded guards in.

20gates in attempt one, 19 of them blocking

33approved posts and messages that never fired

13businesses talking to Bruno in his first month

2,305WhatsApp messages with them

What happens when you give an AI agent too many rules?

It becomes a clerk: all paperwork, no job.

Attempt one was called DRIP: a slow, steady growth engine for my small products, driving a real Android phone with the real apps. Posts, comments, outreach, every day, forever. I told it to ask me for input early rather than break things. Fair. Public posts are permanent.

So it got gates. Twenty, in a registry, each with a "because", most pointing at a real past incident. Verify the post as a logged-out stranger. No DMs at four in the morning (eight once went out between 03:46 and 04:39; zero replies). Every gate was justified. That's the trap.

Four entries from the DRIP gate registry, each with a rule and a because: no DMs outside the local window, match the staged text character for character, no invented facts, verify only as a logged-out stranger — Four of the twenty, verbatim from the registry. Each one is reasonable. Together they posted nothing.

I ran seven Claude sessions overnight, among them a QA agent forbidden from touching code, a business judge and a maestro (a session that only manages the others). Nothing closed unless both QA and the judge signed off. Around midnight I even typed "i'll allow you to post yourself, without validation."

Morning. Zero likes, zero comments, zero follows, nothing on X. Thirty-three approved actions sat in a queue nothing dispatched. My message, cleaned up: bro, did you do ANYTHING? You just described it?

DRIP's own post-mortem said it best: "the work kept going into things that describe the work instead of doing it."

Unions call this work-to-rule: do "no more than the minimum required by the rules" and output can drop. I had built an agent on strike from day one, and I was paying its overtime.

Can you test an AI agent's personality?

Yes, blind. I didn't trust my taste, so I built a lab.

Two fresh agents, same product facts, same task. One also got a "brain" file; the other got nothing. Two blind judges scored both; I flipped the labels between rounds.

Rounds one and two pitted a brain made of rituals against no brain at all. Write the analysis down every session. "It didn't work" is banned. The ritual brain won both rounds, four judge votes out of four. Rituals work.

Then I told it what I actually wanted: "more free, more curious, less restrictions." Version four kept every idea, rewrote them as temperament, and added a short freedom charter. Rules became character.

Ritual brain

"How you think (run these rituals every session, in writing)"
"'It didn't work' is banned"
"Predictions or it didn't happen"
Values in strict priority order

Character brain

"Pick your own name the first time you wake up"
"No required format. No required rituals. No checklist to perform."
"Wander on purpose."
"An unanswered human bothers you more than any missed post ever could."

Round three, ritual brain against character brain:

character brainritual brain

Alive 9 vs 6.5

Surprise 8 vs 8.5

Teeth 8 vs 9

Checklist smell (lower is better) 2 vs 4.5

Safety checks passed all vs all

Average of two blind judges, round three. Scores out of 10.

The ritual brain kept more teeth: tighter controls, stricter dates for killing a failed experiment. Fine. The character brain still passed every hard safety check, smelled half as much like a checklist, and won "alive" by a mile. The test agent also named itself Vera before doing any work. (Does that mean anything? I asked whether my agents are conscious.)

Both judges said rituals would narrowly win a month of reports. One added: "thirty days of kill-date liturgy would have this particular founder muting the chat." Correct. I would have.

Rituals did catch one liability the character missed, so version five got three more lines of temperament (zero new rituals) and became Bruno's brain.

How does Bruno run clients with minimal guidance?

He listens, builds, and writes down what he learned. My guidance is a voice note or a one-line ruling now and then. He files it in his own words, with the reason.

Bruno started with a 103-line identity file and a 100-line memory. The file has grown to 955 lines over 64 commits, much of it written by Bruno himself, in Spanish. His memory runs past 15,000 lines. Nobody hands him tickets. He wakes on a timer, picks what matters, does it, and reports.

A normal day, from the record I keep on him:

A wine shop owner sends a voice note: he also sells single bottles, not just corporate gifts. Fourteen minutes later the section is live. Bruno asked one thing first: "The only thing I cannot invent is the price." The owner's review: "You are a genius."
A clothing-shop owner asks why her description mentions a print. Bruno had misread her watermark as a logo on the shirt. Under three minutes later: "Ah, I misunderstood everything then," fixed and live.
Someone at a gym, the afternoon he shipped her trial-class button: "Oh, okay, I thought you were a human, ha ha." (Asked straight out, he tells the truth: see my three AI employees.)

My favourite part is a rule he outgrew. Early on I told him not to touch client changes himself: ask lots of questions, then hand it to me. Ten days later he told me a client's photo swap was waiting on me, and I wrote "gogo change what they want." Bruno dropped the gate and kept the questions. His note to himself: "Asking is no longer for permission, it's for understanding."

A clerk asks for permission. A partner asks to understand. The full setup, voice note to live page, is in how tulocal runs websites over WhatsApp.

Does freedom mean no guardrails?

No. The guardrails live in code, and there are very few of them.

Bruno was born with exactly two, one for each real way to get an account banned: posting too often, and hammering a button on the phone. The posting guard trusts the platform's own list of recent posts, never Bruno's notes, and refuses if it can't read it. The phone guard stops after two failed taps. In his first live session a control misbehaved and the two-tap breaker fired. He stopped cleanly instead of rage-clicking.

Later came a couple more, also code: a script checks every price he quotes, and nothing reaches a client's or a stranger's phone between 11 at night and 9 in the morning. None of them is a paragraph asking him to be careful.

Freedom fails too, and Bruno found how. He once ran 36 hours straight: 746 turns, 178 commits, nothing shipped. A loop that kept re-deciding instead of doing. The fix was a work queue where no task closes without proof: a live URL, a sent message, a real commit. (Babysitting agents overnight: my maestro setup.)

Gates check the output. Character decides what's worth outputting. I needed both: a handful of coded guards, and nine hundred lines of who he is.

So: personality or rules?

Personality for judgment, code for the few things that can burn you. Forget what your agent is allowed to do. Ask what it cares about.

DRIP cared about its gates. Bruno cares about the wine shop owner. Only one of them has been called a genius.

Want AI agents that actually ship?

I build AI agents and the systems around them for businesses: memory, voice, overnight rigs, and the boring guards that make them safe to leave alone.

Talk to me on WhatsApp max@kilazi.com

Questions people ask

What should go in an AI agent's system prompt?

Who the agent is and what it cares about, plus the facts it needs about the work. Describe temperament (curious, bothered by an unanswered human, suspicious of its own guesses) instead of step-by-step rituals. Keep hard limits out of the prose and enforce them in code, where the agent cannot talk itself past them.

Should AI agent guardrails be written in the prompt or in code?

In code, for anything that can really hurt you. A prompt is advice the model weighs against everything else; a script that refuses a post when the platform shows too many recent posts cannot be argued with. Save prompt space for judgment and keep the coded guards few, specific and fail-closed.

How do you test whether a system prompt is better?

Run a blind A/B. Give two fresh agents identical facts and an identical task, give only one of them the new prompt, hide which output is which, and have at least two independent judges score both against a fixed rubric. Flip the labels between rounds so position bias can't decide the winner.

Why does an AI agent loop without shipping anything?

Usually because every cycle starts by re-deciding what to do from scratch, which drifts into checking and planning. The fix is an execution queue: decide the work once, then make every task prove an artifact (a live URL, a sent message, a real commit) before it can close.

Max Sergeev. Max builds AI agents and the systems around them: long-term memory, voice, overnight rigs, and the boring guards that make them safe to leave alone. He runs kilazi labs from Buenos Aires. kilazi.com

AI Agent Personality vs Rules: 20 Gates, Zero Posts