The Configuration Surface
Six configuration mechanisms, the rule for choosing among them, what bloat looks like, precedence, and how to inventory before optimizing.
Map every mechanism that can inject content into an agent’s context, ordered by when it loads and what it costs because choosing the wrong mechanism is the most common and most expensive configuration error.
14.1 The Six Mechanisms #
Every major agent surface has converged on roughly the same set, albeit under different names.
| Mechanism | Loads | Cost profile | Governs |
|---|---|---|---|
| Instruction file | Every turn, always | Recurring, per turn, forever | Standing rules |
| Path-scoped instructions | When a matching file is touched | Recurring once loaded, for as long as it is retained (§15.6) | File-type rules |
| Skill | When the model judges it relevant | Metadata always; body recurring once loaded (§16.1) | Procedures |
| Tool / MCP server | Schemas every turn unless deferred; results when called | Large recurring block plus per-call | Capability |
| Subagent | When delegated to | Separate window; summary returns | Scope isolation |
| Hook | On a matching event | Negligible tokens; deterministic | Enforcement |
The column that decides everything is the second. A mechanism loading on every turn amounts to a subscription, whereas one loading on demand amounts to a purchase. Putting on-demand content into an always-on mechanism is the critical configuration mistake, and nearly every repository has done it.
14.2 The Decision Rule #
One question, asked in the following order, resolves nearly every case:
→ Hook. A grant can narrow what is reachable; only a hook enforces a rule (§19.1).
→ Instruction file.
→ Path-scoped instructions.
→ Skill.
→ Tool or MCP server.
→ Subagent.
The third and fourth questions catch the majority of real misuse. Most bloated instruction files are a collection of procedures that should be skills, and most of the rest are rules that should be path-scoped.
14.3 What Bloat Looks Like #
A real pattern, anonymized, illustrates it. A repository instruction file of 3,400 tokens containing:
| Content | Tokens | Where it belongs |
|---|---|---|
| Project overview duplicating the README | 600 | Nowhere—the model can read the README |
| Full release procedure, 14 steps | 900 | A skill |
| React component conventions | 500 | Path-scoped to **/*.tsx |
| Database migration procedure | 700 | A skill |
| Six genuine house rules | 180 | Stays |
| Historical rationale for four decisions | 520 | An ADR |
After correction, the file carries 180 tokens always-on, 500 tokens that load when a React file is first touched, and 1,600 tokens that load on the rare turns which actually run a release or a migration.
The arithmetic, on Sonnet 5 at $2.00/MTok base input,26 for a twenty-developer team averaging forty turns per developer per day:
20 devs × 40 turns × 22 working days = 17,600 turns/month
Before: 17,600 × 3,400 tokens = 59.8M tokens
After: 17,600 × 180 tokens = 3.2M tokens
+ ~30% of turns × 500 (React) = 2.6M ← assumed residency
+ ~2% of turns × 1,600 (skills) = 0.6M ← assumed residency
-------
6.4M tokens
Uncached delta: 53.4M × $2.00/M = $107/month
Two premises are doing work in that arithmetic and both should be stated. It is an uncached delta, so it is the worst case rather than the bill. And both conditional lines use a matching frequency where the quantity that bills is a residency fraction—the share of turns that carry the content, not the share that trigger it. Neither mechanism unloads itself once loaded: a skill body stays in the conversation (§16.1), and so does a path-scoped rule on Claude Code (§15.6), until compaction or a reset clears it. On sessions that touch a .tsx file early and then run long, the React line is closer to always-on than to 30 percent, and the same argument applies to the skill line. Both sit at cached-read rates on the turns that retain them, which is the reason this stays a small number rather than a large one. The 30 and 2 percent are therefore assumed residency fractions, and the arithmetic is correct given them—read the figure as an order of magnitude for the always-on line, which is where the 3,200-token cut actually lands, not as a model of what the conditional lines cost.
A hundred dollars a month is not, however, the point. The point is that the same edit removes 3,200 tokens of dilution from every turn, and dilution is what the evidence in §12.1 says degrades reliability. The cost saving is a rounding error; the quality effect is the reason to do it.
14.4 Precedence #
When two mechanisms say different things, which prevails? Two halves of that question behave differently. Enforcement is settled: enterprise-managed policy and platform controls sit above anything a repository can set for itself because the repository cannot edit them (§19.1, §20.4). Textual priority—which sentence the model weighs more when two of them conflict—is under-documented and varies by surface, so the hierarchy below describes a tendency rather than a rule:
Enterprise / organization policy ← highest; usually cannot be overridden locally
Repository instruction file
Path-scoped instructions ← more specific wins over less specific
Personal / user-level config
Skill content ← loaded content, competes on merit
The current message ← usually wins in practice, being most recent
Two vendor facts cut against the middle of that stack. GitHub documents personal instructions as highest priority, repository instructions next and organization instructions last, which inverts two of those rows. And Claude Code loads user-level rules before project rules while stating that neither set overrides the other, so a conflict between them may resolve either way. The order therefore holds only as far as your own surface’s documentation says it does, and Part VI gives each platform’s configuration surface.
Two footnotes that matter in practice. Nearest-file-wins is a property of the hosts that document it—Codex implements the AGENTS.md specification’s nesting rule, so an AGENTS.md in packages/api/ takes precedence over the root one for work inside that package (§43.1)—and it does not follow from nesting support alone. Claude Code and Copilot CLI both discover nested files and both concatenate what they find rather than overriding: Claude Code orders the content from the filesystem root down, so the nearest file is read last and gains whatever recency buys, but the documentation is explicit that files do not override each other and that contradictory instructions may be resolved arbitrarily.48 Discovery order is not conflict resolution. Where two nested files can disagree, fix the disagreement rather than relying on depth to settle it. And the last item is why an explicit instruction in your message reliably overrides a stale instruction file—recency is a strong signal, which is a useful escape hatch and a security problem in equal measure.
14.5 Inventory Before You Optimize #
One cannot fix a configuration surface one has not measured. Every mature surface exposes a way to see what is loaded.
# Claude Code
/context # what is in the window right now, by category
/cost # spend for the session
# GitHub Copilot CLI
/context
/usage
# Codex
/status
Run the inventory command on a fresh session with no prompt entered. Whatever it reports is your fixed block—the tokens you pay on every single turn before doing any work. Most teams have never looked at this number, and most are surprised by it. Tool definitions from connected MCP servers are usually the largest line item, frequently exceeding the instruction file by an order of magnitude.
References cited in this section
2 of 81 · numbering matches the PDF
- 26Anthropic model pricing, published in the pricing table of reference 12 and verified September 8, 2026. Source for all Claude per-model rates: Fable 5.1 $10/$50, Opus 5 $5/$25, Sonnet 5 $2/$10, Sonnet 4.6 $3/$15, Haiku 4.5 $1/$5 per MTok, with cache multipliers of 1.25× (5m write), 2× (1h write), and 0.1× read (0.025× on Fable 5.1 and Mythos 5.1).platform.claude.com/docs/en/about-claude/pricing ↗
- 48Claude Code documentation (settings, hooks, sub-agents, and skills references), verified September 11, 2026, cross-checked against an independently compiled feature and settings snapshot at https://hidekazu-konishi.com/entry/claude_code_features_settings_reference_2026.html. Vendor documentation plus a third-party catalog that links each row back to the official docs. Cited for the settings precedence tree (user, project, project-local, CLI flags, enterprise managed, in ascending precedence, with the managed layer a floor that CLI flags cannot relax for scalar values and deny rules—list-valued keys such as permissions.allow and the sandbox allow and exclusion arrays merge across scopes instead, so lower scopes can add entries and widen access, which allowManagedPermissionRulesOnly exists to prevent for permission rules), the hook event catalog including PostCompact and its auto/manual matcher, the hook exit-code semantics, subagent frontmatter fields and isolation: "worktree", and the documented routing of subagent permission prompts—foreground subagents pass prompts through to the user, background subagents surface them in the main session naming the asking subagent, and auto-denial is a permission-mode behavior rather than a property of delegation. An earlier revision of this entry asserted that subagents cannot raise interactive prompts at all, so approval-required calls always resolve as denials; that was wrong, and §18.5 was corrected before this entry was. The same revision compressed the exit-code semantics to "0 allow, 1 allow with warning, 2 deny," which conflates the handler's process status with the event's decision, and the hook printed in §19.2 is the counterexample: it emits a permissionDecision of deny and exits 0. Exit 0 means the handler succeeded and Claude Code reads the decision from stdout JSON—silence is not approval, it is merely no decision, and the call continues through the normal permission flow. Exit 1 is a non-blocking error that Claude Code proceeds past, not a warning-flavored allow. Exit 2 blocks, but which events can block is event-specific: PreToolUse and UserPromptSubmit block, while PermissionRequest, PostToolUse, Notification, SessionStart and others do not honor it. Read the per-event table rather than a three-value mapping. Also cited, against the memory page and the v2.1.277 release notes of September 18, 2026, for native AGENTS.md loading and its conditions: by default Claude reads AGENTS.md only where no CLAUDE.md, .claude/CLAUDE.md or CLAUDE.local.md sits in the working directory or above it, while a user-level CLAUDE.md, a managed one and .claude/rules/ files do not count against it; a Project instructions setting in /config selects other modes, including loading both; and nested and subdirectory files load on access. The provider limitation this entry previously recorded as current is now version-scoped: the memory page places it before v2.1.281, published September 23, 2026, and directs affected Bedrock users to update rather than describing an ongoing platform gap. The verification date in this entry was accurate when made; this is a product change after it, not a correction to it. The conditions that remain current are an installation before v2.1.277, a disabled agents-md plugin, and in some cases the first session after an upgrade. An earlier revision of this document said Claude Code simply does not read AGENTS.md and presented the import line as a universal requirement; §15.2, §38.6, §43.1 and Appendix D were corrected together. The third-party snapshot is dated May 2026 and its model-name rows are consequently stale against the lineup in reference 12; the mechanism rows cited here were re-checked against the current official pages.docs.claude.com/en/docs/claude-code ↗