Article · 2026-09-23
Stop Claude Code and Cursor from editing files you didn't ask for
Rules steer intent. Permissions and a scope-vs-diff check keep the next session in bounds.
Packaged rules that target minimum viable change and no orthogonal damage: Claude Code Master Config Bundle ($37.60). Still needs your denies and a diff check. Details below.
You asked Claude Code or Cursor to fix one file. The diff also changed a shared helper and a legacy path you never named. That is wrong-file editing: scope creep, also called orthogonal damage (edits outside the task).
A line in CLAUDE.md or .cursor/rules is not enforcement. Rules steer intent. Permissions, deny lists, and hooks can block tools. A scope-vs-diff check after the run catches what still slipped. You need all three layers if you want the next session to stay in bounds.
What the failure looks like
Cursor users report the same shapes over and over. A May 2026 Cursor forum write-up groups them into three patterns. Treat those as community reports, not Nightforge survey counts.
1. Helpful clean-up on shared utilities
You ask for a change in src/features/auth/login.ts. The agent follows an import into src/utils/helpers.ts, sees old style, and refactors the watering-hole file. Twenty features depend on that helper. You get a “small cleanup” that is really a blast-radius surprise.
2. Legacy / wrong-path edit
You meant src/components/UserAvatar.tsx. Retrieval prefers src/v1/UserAvatar.tsx or a deprecated twin. The agent edits the dead path. The bug you care about stays open. Dead code drifts further from production.
3. Cascading refactor
One type error opens an interface file. The agent “fixes” the type, then updates every implementer. A one-file request becomes a multi-file architecture diff you never approved.
Claude Code hits the same class of failure: lookalike names, import-chain drift, and “small cleanup” of neighbors. Practical recovery guides stress the same split: prompt text shapes intent; only permission denies (or hooks) actually stop the edit (AI Tools Guidebook).
Why “don’t touch X” in rules keeps failing
Rules live in context. As the session grows (files read, errors, prior turns), the model optimizes for clearing the immediate failure. Negative constraints (“do not modify src/auth/”) get softer when a shared util looks like the shortest path to a green compile. Practitioners and tool authors describe this as observed agent behavior under load, not a peer-reviewed law.
Anthropic’s own Claude Code docs draw the same line. Project memory files such as CLAUDE.md are persistent instructions Claude reads at session start. They are context, not a hard block. To refuse an action no matter what Claude decides, you use something else: permissions, or a PreToolUse hook (How Claude remembers your project, Best practices for Claude Code).
Cursor’s guidance for agents points the same direction: Plan mode, review, rules, ignore files, and committing before agent sessions. A DEV Community write-up on .cursorrules vs scoped .cursor/rules/*.mdc makes the blunt point that prose preferences are not folder-level enforcement (Why Cursor Agent Ignores Your .cursorrules). Scoped rules help. They still are not a substitute for a post-run diff audit when the agent retains write access.
Rules vs enforcement
| Layer | What it does | What it cannot do |
|---|---|---|
Rules / CLAUDE.md / .cursor/rules | Steer behavior: stated scope, minimum viable change, no orthogonal damage | Block a tool call the model decides to make |
| Deny / permissions / PreToolUse hooks (Claude Code) | Refuse or gate tools and paths | Fix a bad plan by itself |
.cursorignore / path scoping | Keep files out of context or harder to reach | Guarantee zero over-edit if write access remains elsewhere |
| Scope-vs-diff audit (after the run) | Flag files changed outside declared scope | Prevent the edit in real time unless you wire it as a gate |
Keep that table in your head. Intent without a gate is a wish. A gate without a declared scope is a black box. A diff audit without either is cleanup after the fact.
A practical stack you can run today
1. Before the agent runs
Name the allowed paths in the prompt: “only touch src/features/auth/.” Use full paths, not “the auth file.” Commit or branch first so a bad run is one revert away.
2. In rules
State minimum viable change and no orthogonal damage in plain language. Require the agent to name any extra file *before* editing it. Keep the rule file short and high-signal. Do not paste a novel of forbidden paths into context if those paths should be hard-denied instead.
3. Hard gates
For Claude Code, put real denies on critical trees (auth, billing, migrations, generated output) in project permissions, or use hooks for paths that must never move. For Cursor, combine Plan mode, Agent Review, scoped .mdc rules, and ignore rules for sensitive paths. Product names differ. The job is the same: the tool layer must be able to say no.
4. After the run
Compare declared scope to reality:
git diff --name-onlyAnything outside scope gets rejected or reverted before merge. The Cursor forum pattern of declared-scope vs actual-diff is the same idea, whether you use an MCP auditor or a one-liner you already trust.
5. Optional second pass
Run an independent reviewer prompt on the diff (scope-creep detector). Do not ask the same chat that wrote the code to grade itself. Fresh context is the point.
Before / after example
Ask: Fix the validation message in src/features/auth/login.ts. Do not edit anything else.
Bad diff (orthogonal damage):
src/features/auth/login.ts(intended)src/utils/helpers.ts(helpful clean-up)src/v1/auth/login.ts(legacy twin)
Good outcome: only login.ts changes. If the agent believes helpers.ts is required, it stops and names that file first. You approve or refuse. Then you re-check git diff --name-only.
Where Nightforge fits
You can build the stack from docs and a shell alias. Nightforge packages pieces of it if you want a ready drop-in.
- Claude Code Master Config Bundle ($37.60) encodes behavioral rules aimed at minimum viable change and no orthogonal damage (public sample Rules 2-3 on the product page), with install notes for Claude Code, Cursor, Windsurf, and Copilot. Rules still need your denies and your diff check. The bundle does not claim zero wrong-file edits.
- Regression Risk Estimator is an offline HTML check that scores a diff, including out-of-scope files.
- Independent Reviewer & Scope-Creep Detector System Prompt Kit is a second-opinion prompt pack for the diff, not a same-session self-review.
- Free starter checklist if you are not buying yet.
Treat these as one packaged way to encode the stack. They are not a requirement to be safe.
FAQ
Can CLAUDE.md alone stop wrong-file edits?
No. It is advisory context. Anthropic documents memory files as instructions Claude tries to follow, not as a hard enforcement layer. Use permissions or hooks when a path must never be touched.
Should I put every forbidden path in the rules file?
Prefer hard denies for truly off-limits paths. Keep rules short and high-signal. A long deny essay in context still loses to a compile error under load.
Is this Cursor-only?
No. The same failure modes show up in Claude Code and other coding agents. Tool names differ (rules files, Plan mode, permissions, hooks). The three-layer stack stays the same.
How do I scope Claude Code to one directory safely?
Declare the directory in the prompt, gate critical siblings with permissions or hooks, then audit git diff --name-only against that declaration before you accept.
Why does the agent ignore “don’t modify src/auth/” in the rules file?
Because that line is preference in context, not a tool refuse. When fixing the error seems to require auth code, the model may treat the rule as optional. Put a real deny on src/auth/ if it is sacred.
Close
Wrong-file edits are not a mysterious personality quirk. They are what happens when advisory rules meet tool access and a growing session.
- Rules for intent (minimum viable change, no orthogonal damage, name extras first).
- Hard gates for tools and paths.
- Scope-vs-diff before you merge.
Start with the free starter checklist. If you want a packaged rules file that already targets Rules 2-3 style constraints for Claude Code and Cursor, the Claude Code Master Config Bundle is the primary Nightforge option. Pair it with denies and a diff audit. Do not skip the gates.