Write the rules once.
Installing them is switching them on.

Somebody has to decide how AI gets used across every repository you own. Deciding is the easy half. The hard half is making that decision arrive at two hundred teams, stay there, and still leave those teams able to work.

The worked example How it composes
  • one entry point
  • three merge rules
  • no removal API
$ in-lockstep pack describeacme-lockstep installed, excerpt
policy
  acme-baseline  <- plugin:acme
  framework-floor  <- in-lockstep
  = network=(unset) scan=block deny_tools=1 max_turns=16

standards
  acme  <- acme-lockstep 1.0.0

This repository's own floor asks for 100 turns and a warn-level input scan. The organization's package asks for 16 and block. The merged line is what a run is handed, and on every field it is the stricter of the two.

The org layer is a pyproject.toml and one function.

Drawn: the four bands. At one repository, a contributed line is enough. At two hundred, a line every team has to remember is drift with a nicer name. So standards travel as a distribution, and Lockstep.detect() applies every installed one before your module's own lines run.

acme_lockstep/__init__.pyexcerpt
from in_lockstep import Policy


def apply(std: Any) -> None:
    # The org-wide floor. `scan_input="block"` is
    # strictest-wins in the stack, so no later layer
    # can soften it to "warn"; `max_turns` merges
    # lowest, so a repository can tighten it to 8 and
    # cannot loosen it to 50.
    std.contribute(
        Policy(
            name="acme-baseline",
            scan_input="block",
            max_turns=16,
            deny_tools=("run_script",),
        )
    )

The function is handed a facade, not the configuration. It can contribute policy layers and bind implementations, and nothing else: the middleware chain, the budget and the model routes stay with the repository.

pyproject.tomlexcerpt
[project]
name = "acme-lockstep"
version = "1.0.0"
dependencies = ["in-lockstep"]

# The group in-lockstep discovers. The NAME ("acme")
# orders application when several standards packages
# are installed — org before team is "00-acme"
# before "10-payments-team", stated in the name where
# everyone can read it, rather than left to resolver
# order nobody can.
[project.entry-points."in_lockstep.standards"]
acme = "acme_lockstep:apply"

There is no import to remember, so there is no import to forget. There is also no environment variable that skips loading, and a package that fails to load stops the run rather than quietly proceeding without the standards somebody installed.

Layers combine. They never replace.

Contributions append, and the merge only ever tightens. A team can sit inside your floor, or further inside it, and there is no way to dig underneath.

The tighten-only stack Three nested rectangles, each narrower than the one containing it. The outermost is the framework floor shipped by in-lockstep. Inside it is the organization's standards package, applied at plugin tier. Inside that is this repository's own lockstep dot py, and its interior holds what a run is handed: max turns sixteen, scan input block, one denied tool. Down the right side are the three merge rules: max turns merges to the lowest and never the last read, deny tools unions with no subtraction, and the strictest scan of any two wins. An arrow pointing out through all three boundaries is crossed out and labeled: there is no removal API. framework floor in-lockstep org standards plugin:acme this repository .lockstep/lockstep.py max_turns 16 scan_input block deny_tools 1 there is no removal API how layers merge max_turns merges to the lowest, never the last read deny_tools unions, and there is no subtraction scan_input the strictest of any two wins
Every ring can narrow the one outside it. Nothing widens.
$ in-lockstep lsnothing installed, excerpt
standards  (in_lockstep.standards entry points; applied
           before this module's own lines)
  (none installed)

policy
  framework-floor  <- in-lockstep
  = network=(unset) scan=warn deny_tools=0

This repository on its own. Its floor allows 100 turns, warns on untrusted input rather than refusing it, and denies no tools.

$ in-lockstep lsacme-lockstep installed, excerpt
standards  (in_lockstep.standards entry points; applied
           before this module's own lines)
  acme  <- acme-lockstep 1.0.0

policy
  acme-baseline  <- plugin:acme
  framework-floor  <- in-lockstep
  = network=(unset) scan=block deny_tools=1

One line in a dependency list later, with nothing else in the working tree changed. The team's own layer is still listed and still says where it came from, because a rule that had no effect is worth being able to see.

Everything you did not decide is still theirs.

Drawn: prompt composition. A composed prompt is a typed stack of fragments, and guardrails are inlined first and verbatim, because their position is a security property rather than a rendering preference. A team can add to that stack. One command prints what their addition changed, before a run costs anything.

$ in-lockstep show-prompt review/security --projection
config    local working tree
guardrail:baseline
guardrail:review/reviewing
body:review/security-reviewer
skill:review/review-format
skill:review/review-revision

Five fragments in a fixed order: guardrails, then the body, then skills. It reads the prompt off the bound adapter, so what it prints is what a run would use, and it costs no key and no spend.

$ in-lockstep show-prompt review/security --diff
config    local working tree
# review/security is the shipped prompt, unmodified.

The same prompt against the shipped one. Here the answer is that nobody has touched it. Where a team has, this prints the diff, which is the review question rather than the rendering one.

A repository that deliberately wants something else writes one lockstep.bind. That is Tier.EXPLICIT and it wins whether it ran before the package or after, while everything a standards package binds is Tier.PLUGIN. The facade offers no tier parameter at all, so a package cannot bind as though it were the repository's own line.

That freedom is the point rather than a concession. Rules that get in the way get worked around, and then you have the same problem plus the belief that you solved it. The floor holds the small set of things you were willing to argue for. The rest is a team's to decide, in a file that goes through review like any other code.

Visibility of removal, not impossibility.

A team can remove your rules. What they cannot do is remove them without anyone noticing.

Nothing installed inside a repository can bound the person who owns that repository. Any tool telling you otherwise is selling you the feeling of control rather than the control. So the effort goes into making every change to the setup a diff with a name on it, and the enforcement that has to survive a determined owner goes somewhere the repository cannot reach.

  • A repository can go around all of it. It can import a provider SDK directly and never touch the policy stack, the spend accumulator or the egress check. The controls crosswalk records that rather than mitigating it, because a library cannot promise otherwise.
  • Every field reaches a run. max_turns, max_idle_turns, deny_tools and scan_input are composed into the loop, and a test pins that set so a field that enforces nothing cannot be offered. network, permissions and the credit fields were deleted rather than wired, because each already had a control covering the same ground.
  • The ceiling that survives is your provider's. doctor fails this repository until somebody attests an organization spend limit set in the provider console, because a per-run budget cannot bound a runaway trigger.
  • Enforcement lives in a required check. doctor --strict is what an organization requires before a merge, and it reads the baseline from the check's own environment rather than from the repository under check.
$ in-lockstep doctor --strictorg baseline set, exit 1, excerpt
ERROR   DOC162  required policy layer 'acme-baseline' is
                 not contributed
                 The organisation baseline
                 (IN_LOCKSTEP_REQUIRED_POLICIES) names
                 layers this module must contribute;
                 present: framework-floor. A deleted
                 standard is a visible diff — this is the
                 check that sees it.
ERROR   DOC163  the resolved turn ceiling is 100; the
                 organisation's maximum is 16
                 Contribute a policy layer with max_turns
                 at or under the org maximum.

6 finding(s), 4 error(s)

This repository with the example package uninstalled, and the organization's floor named in the check's environment. Two of the six findings are the organization's, and both say the same thing: the standard is not here, and the check that noticed is the one holding the merge.

One package, every repository, every change a diff.

The worked example ships in the project and it is about thirty lines. Install it anywhere and ls tells you exactly what it did.

$ uv tool install 'in-lockstep[anthropic]' && in-lockstep ls

The whole org layer

A pyproject.toml and one function, with the precedence story written next to it.

Where it does not reach

The limits, unhedged, and the same list the tool checks itself against.

The other half of the rule

Standards apply themselves because they can only tighten. A pack spends money, so it arrives as a diff.