Chapter three. Three days after the naming, in a repository that had never met the agent, one line became a required field — the half of a definition nobody writes down.

Every agent definition I have written says what the agent is. None said what it must not become. A successor system's schema made that a required field — anti_identity, twenty characters or the record is refused — and one of its three values reads, in full: "Not the maker of the work I grade. Not a cheerleader." That is the one line a reviewer can hold an output against, because the positive half of any persona is satisfied by anything that looks right.

Thesis: The positive half of any persona is satisfied by anything that looks right. The negative half excludes an artifact, which makes it the only line in a role definition a reviewer can hold an output against — and that is why it belongs in a schema, as a required field, rather than in prose. It is not an instruction to the model. It is a grading target for whoever reviews the output and a scope fence for whoever extends the role, and it costs one schema line.

The Positive Half Is Always Satisfiable

Here is the problem with "you are a meticulous compliance expert."

A meticulous compliance expert produces a well-organized findings document. So does an agent that read the wrong source, skipped the hard controls, and listed only the ones that passed. Both artifacts satisfy the description. The description cannot separate them, because it describes a disposition and the failure is a shape of output.

This generalizes. Every positive persona clause I can find in our repositories has a plausible-looking artifact that satisfies it while being wrong:

The negative clause is different in kind. "Not a landfill with an index" excludes an artifact. You can hold a corpus against it and get an answer.

What It Looks Like in a Schema

Three days after the naming, in a different repository, I asked for a system that runs agents as heroes — a class each, a ladder of levels, a ledger of awards; chapter six takes that machinery apart. Every hero is a record, and the record has twelve required fields. One of them is anti_identity, minimum twenty characters. Not a convention, not a lint rule — a schema validation that refuses the record:

The three live values, verbatim — and each one does a different job:

Quartz names the two roles it is most likely to be mistaken for — Cairn, and harvest, the sibling that gathers evidence. In the multi-agent systems I have run, role confusion is with the neighbouring role, not a distant one, so naming the neighbour is where the fence earns its keep. The first of those neighbours is the name from chapter one; what the successor did with it is chapter seven's story.

Gleam encodes a structural rule as an identity. "Not the maker of the work I grade" is the independence property, stated as self-conception. The same rule is separately enforced in code — a string comparison that refuses an award, and separately a rung close, when the verifier equals the maker; chapter six has the transcript. The field and the guard say the same thing in two registers. That is the pattern worth copying: state it as identity for the human, enforce it in code for the machine.

Seventeen Minutes

The field was mandatory seventeen minutes after the successor repository's first commit, on the morning of 2026-08-07 — by the ledger's first award it already had a validator. Every stamp that bounds the window was written by a clock, not typed by anyone:

Inside those seventeen minutes a forge command — the successor's tool for writing a hero record — wrote three of them, Quartz, Ashen and Gleam, each with a populated anti_identity, and the validator in that same file already listed the field among twelve required keys and refused any value under twenty characters: anti_identity too thin.

The who is on record too. The session that did it — logged in the ledger under the maker label forge-session — survives in the delivery pack, the archive of session records this series draws on, as a Cursor transcript. One session wrote the schema that made the field required, wrote the validator, and typed all three values into a single chained forge line by hand. The commit and the ledger bound the window; nothing typed does — the two typed stamps the table leaves out are in the note that closes this chapter.

What the record holds beyond the when and the who is the field's descent. Earlier in the same session it had read the upstream composition procedure that defines a wrong-work statement; one message before it typed the schema, its own harvest yield — the document the session wrote from the context it had gathered — cited that file by name and listed "wrong-work" among the identity slots. The successor's contract later defined the slot with the same question — what would make this session's work look done but be wrong — and that question has an older home.

The Upstream Version: A Wrong-Work Statement

Before the schema field existed, the same idea was step six of a seven-step composition procedure — a "wrong-work statement," one paragraph long, whose prompt is a clause this chapter reads as a question:

what would make this session's output look done but actually be wrong

That clause is the whole prompt; the paragraph is the answer. The procedure's own note on it is the argument for the whole idea: "This is the anti-identity; it makes the block alive and falsifiable."

I have started asking this at the top of any non-trivial agent brief, and the answers are consistently more useful than the goals. "Look done but be wrong" forces you to picture the plausible bad artifact, and once you can picture it you can usually write a check for it.

Downstream of the Model

The field is real, required, and populated. What has not yet been run is the experiment that would test it — a reviewer holding an output against it — and the record says so in five words: five days after the field was written, on 08-12, a harvest pass over the repository reduced it to "Anti-identity is schema-enforced and unmeasured." The first half is the record. The second is the to-do.

What the record does not hold is a reason. The transcript shows the values being typed, not weighed; no line argues for the floor of twenty characters, and the commit message is silent. The nearest thing to a purpose statement is one clause in the first draft of the skill file the same session wrote — "anti-identity binds refusal" — in a draft that pasted the whole hero card, field included, into the session. By the afternoon the session's own rewrite had dropped both the clause and the paste instruction. The committed skill still tells the hero to emit its card, and that card prints the field under its own heading — the successor shows the line to the agent as a card entry, not as a command, which is the form the next section argues for.

What we do have measurements for is adjacent, and it points where this chapter points — at the bar, not at the prose over it:

The first row is the failed experiment the agent cited against its own vanity in chapter one; the second is the battery chapter five is about. On the one question those two could ask, adjectives in a persona slot do nothing. anti_identity is not an adjective, and it is not doing the job they tested. They measured whether text in a persona slot changes model behavior at inference. This field's function is downstream of the model: it tells a reviewer what to look for, and it tells the next engineer extending the role what is out of scope. Both are human-facing effects, and an accuracy benchmark is the wrong place to look for either.

When the Opposite Wins

"Negative instructions work badly on language models. Tell it not to think of an elephant and it thinks of an elephant."

The priming effect is real and well documented. It has nothing to act on here, for one reason: anti_identity is not written as a command to the model. It is a field in a definition record. Its consumers are the reviewer checking the output and the engineer editing the role. If you do inject it into a prompt as "never do X," you have converted it into exactly the negative instruction the objection warns about, and you should expect the known problems.

Keep it metadata: something to grade against, not to command with.

There is a second, better objection: the field can become theater. A required minimum length invites padding — an anti_identity that reads "not sloppy, not careless, not unhelpful" satisfies the schema and excludes nothing. Our own vacuity guard elsewhere rejects layers containing phrases like "excellent" or "best practices," which is the right instinct, and it is not applied to this field. If you adopt this, review anti-identity values as adversarially as you would review a test that never fails.

The Sentence That Could Exclude an Output

"Thorough" cannot be checked against a document. "Not forty sources with the authoritative one missing" can. The gap between them is not a writing trick; it is the difference between a description and a specification — and the descriptions are the half that measured inert: adjectives over no bar, no better than an empty slot.

What took longest to see was who the sentence is for.

flowchart TD
    R["a role definition"]
    A["anti_identity<br/>addressed to<br/>whoever holds<br/>the output up"]
    V["the reviewer:<br/>this one is out<br/>the next engineer:<br/>that is out<br/>of scope"]
    M["mentality · voice<br/>mood · traits<br/>addressed to<br/>the model"]
    O["the output"]
    R --> A --> V
    V -.->|"held against"| O
    R --> M --> O
    style R fill:#5a5a8a,color:#fff
    style M fill:#5a5a8a,color:#fff
    style O fill:#5a5a8a,color:#fff
    style A fill:#2d6a4f,color:#fff
    style V fill:#2d6a4f,color:#fff

Every other line in a role definition is addressed to the model. This one is addressed to the person who will hold the output up against it.

Chapter two ended on a question — what in your system could say no to a persona. This is the line you hand that person. The first reader of your anti-identity is not the agent. It is whoever you trust to say no, and the line is what they say it with.

On the record. Two more stamps sit in the record, and the table in Seventeen Minutes leaves them out on purpose: the transcript stamps only my turns and nothing between them, so the 09:45Z figure in the record (04:45 local) is a stamp the session typed into the harvest's lessons.jsonl line, one tool call after the yield — which the session typed as 09:45:00Z; the committed copy reads 09:44:25Z, and the record does not show what changed it. And one lineage the record does not hold. The nearest ancestor in this series is the critic's item B in chapter two: a demand that a want be fenced "so it cannot read as a license." I would like to tell you the field descends from that as well. The record does not connect them.

Next: chapter four takes this line back to the night of the naming, where the agent has a whole document of them to write — about itself. Related: Agent Personas for the five-element model this field is missing from; Persona Lens Design on writing the positive half well; and Grade the Answer, Not the Shape, which is the same argument one layer down — structure is what survives when correctness is gone.