Where AI Coding Agents Actually Read Their Instructions From
Broadest scope at the top, most specific at the bottom. Every layer that's loaded gets combined, not replaced, and nothing is silently dropped for being lower in the order. Miss that, and you'll write a rule in the wrong place and wonder why it never seems to apply consistently, in whichever tool you're using.
The first mistake most teams make with an AI coding agent is treating "instructions" as one file. It isn't, in any tool we've put to real work. Claude Code and ChatGPT Codex both load instructions from several distinct places every time a session starts, and understanding which one to use for a given rule is the difference between a rule that reliably applies and one that only seems to, until the day it doesn't.
The layers, broadest to narrowest
Each layer below can be loaded at once. None of them override each other outright, the agent reads all of them and tries to reconcile what it's told. That has a real consequence: put a rule in the wrong layer and it either applies somewhere you didn't want it, or fails to apply somewhere you needed it. The exact number of layers and what they're called differs by tool, this is the shared shape underneath.
The one fact that's easiest to miss
Every layer above, plus auto memory and on-demand procedures, is context the agent reads and tries to follow. None of it is a hard technical block. If two rules disagree, the agent may pick one arbitrarily, and if a rule is buried where the agent doesn't think to look, it can simply go unapplied. Only one category of control actually forces a specific action or blocks one outright, regardless of what the agent decides in the moment.
Advisory: read and interpreted
- Every layer of instructions above
- Auto memory
- Skills or presets
Actually enforced: runs regardless
- Hooks bound to specific events, before a tool runs, at session start
- Technical permission settings: what's blocked outright, sandboxing
How this looks in the tools we actually use
The pattern above is shared. The file names, tier count, and precedence rules are not. Here's the concrete mapping for the two agentic coding tools we run in production.
Claude Code
Five layers, loaded and combined every session: an org-managed policy file (enterprise deployment only), a global CLAUDE.md at the user level, a project-level CLAUDE.md plus a .claude/rules/ folder, and a personal, project-local override file not shared with the team. Auto memory and on-demand skills load alongside these as a separate, non-hierarchical pair.
ChatGPT Codex
A simpler two-point version of the same idea: a global AGENTS.md in your Codex home directory (yours, across every repo), plus repo-level AGENTS.md files that a team checks in. Files closer to the working directory take precedence over the global one. Codex also tightened this in September 2026: untrusted projects no longer get to supply project-level AGENTS.md instructions at all, a narrower but real enforcement step on top of the file hierarchy itself.
Why this matters in practice
We didn't learn this order from documentation, we learned it from a rule sitting in the wrong layer and quietly not applying to a second project until someone noticed the gap. If something must never happen no matter how it's phrased, it doesn't belong in the advisory layers at all, it belongs in a hook. That's the subject of the next piece in this series.