Modes That Can't Betray You

Runtime behavioral overlays for Amplifier agents

The Gap

You wanted a discussion and got 500 lines of code

You meant to think a problem through first. But the agent has no notion of "mode" — so you re-type "don't write files yet" every turn and still get an implementation you didn't ask for.

Amplifier Modes make that intent structural, not a polite request.

you › let's just plan this out first agent › sure — here's the full implementation… ▲ 500 lines you didn't want

The Proof

In plan mode, `/plan` literally cannot write files

With plan mode active, write_file and edit_file are denied outright — the agent is told the tool is not in the allowed list and to use /mode off to exit.

This isn't a suggestion the model can talk itself out of. Here's the mechanism behind it.

[plan]› refactor the auth flow
# agent attempts write_file…
DENY: write_file is not in the allowed
list. Use /mode off to exit plan mode.

The Mechanism

A Mode is just a `modes/*.md` file with YAML frontmatter

A runtime behavioral overlay you switch on with one command. The bundle ships built-in modes and one hidden authoring mode.

One command does three things — the first is the gate every tool call passes through.

plananalyze, don't implement
carefulfull capability, confirm destructive actions
explorezero-footprint, read-only
mode-designhidden authoring mode (advertised: false)

Enforcement

Every tool call runs a four-tier gate

In the handle_tool_pre hook, each call is checked against four tiers before it runs.

And the mode you're in is never a secret while this runs.

safepasses — continue
blockdenied
confirmroutes to the approval hook
warndeny-then-allow

Visibility

The active mode is never invisible

Mode-specific guidance is injected into each turn as a system-reminder, and the prompt shows [mode]> the whole time it's active.

So far these are lists of what's allowed — but the real guarantee is what happens to everything unlisted.

[plan]› analyze the authentication flow <system-reminder source="mode-plan"> MODE ACTIVE: plan …

The Turn

Anything unlisted falls through to `default_action`

Safety isn't a hand-written blocklist of denials. plan.md never lists write_file or edit_file in any tier — and it sets default_action: block.

So the file-writing tools are denied by the default, not by an explicit rule.

# modes/plan.md
safe:    read_file, glob, grep, …
warn:    [ bash ]
# write_file / edit_file: absent
default_action: block

The Payoff

Planning is guaranteed by construction

Because plan.md sets default_action: block and never lists the file-writing tools, the hook denies them by fallback. The agent can't betray the mode even if it tries — enforcement is structural, not a matter of trust.

The Takeaway

A small, real pattern: make intent a runtime overlay the agent can't ignore

127 commits over six months, in two modules (~1,836 lines of Python), shipped as bundle version 1.3.1 — actively maintained through July 2026.

Turn intent into a mode, and the agent obeys by construction.

127

commits over ~six months

1,836

lines of Python, two modules

4

tool-policy tiers + default

1.3.1

shipped bundle version

Sources

Research Methodology

Shipped & versioned · v1.3.1

Primary source: ramparte/amplifier-bundle-modes (local clone at /home/ramparte/dev/ANext/hq1a/amplifier-bundle-modes; upstream microsoft/amplifier-bundle-modes). Data as of latest commit 2026-07-16.

Commands run:

git log --oneline | wc -l → 127 commits
git log --reverse --format='%ai %h %s' | head → initial 2026-01-14, latest 2026-07-16
git log --format='%an' | sort | uniq -c | sort -rn → Brian Krabach 119, Salil Das 3, Sam Schillace 2, policy-bot 2, Diego Colombo 1
grep -n 'safe_tools|warn_tools|confirm_tools|block_tools|default_action' modules/hooks-mode/…/__init__.py → four tiers + default_action
cat modes/plan.md ; sed -n '857,870p' …/__init__.py → write_file/edit_file absent; deny-by-fallback path
grep -n 'system-reminder|MODE ACTIVE' …/__init__.py ; grep -n ']>' README.md → context injection + [mode]> indicator
ls modes/ ; grep advertised modes/mode-design.md → plan, careful, explore + hidden mode-design
wc -l modules/hooks-mode/…/__init__.py modules/tool-mode/…/__init__.py → 1256 + 580 = 1836
grep version bundle.md ; git tag → version 1.3.1; tags v1.2.0 / v1.3.0 / v1.3.1

Gaps: Unit tests were NOT run in this session (do not claim tests pass). The "500 lines" figure is narrative framing, not a repo metric. The ~604-token reduction from once-per-turn coalescing (commit 3b12c77) is the author's stated measurement, not independently re-measured. PR/issue numbers were read from git log subjects, not fetched via gh.

Primary contributor: Brian Krabach — 119 of 127 commits (~94%), initial author.