Note

Read-only by construction

The most reliable way to guarantee the site never writes to its CMS was not a rule or a review: it was a fetch type with no room for a write.

AI agents write a good part of this site's code. The site reads from a CMS. The question I cared about was simple: how do I guarantee that no code path publishes anything, not through a bug, not through an overconfident agent?

The common answer is discipline. "The site must not write to the CMS", written in the README, in the agent's prompt, in the reviewer's head. Discipline depends on everyone remembering it forever. And an agent can talk its way around a prompt.

The answer I picked is structural. The site's fetch function takes a type that accepts a query URL and nothing else. There is no parameter for an HTTP method, for a body, or for a header. Anyone who wants to write to the CMS from the site has to change that type first, and that change screams in a diff.

The official CMS client does the opposite: create, patch and delete live on the same object that does the reading. So it stays out of the site entirely. It only exists in the Studio, the surface where the human edits, signed in to their own account.

And every query asks for published content only. Drafts are invisible to the site. An agent can produce drafts all day long; to go live, the text runs through a program outside the site that publishes only what survives two checks: no confidential term in it, and the note present in both languages.

That last step used to be me clicking publish. I dropped it. It judged nothing the checks had not already judged, and a click that judges nothing is a rubber stamp. The final word is still mine, one step earlier: in the text I write and the code I approve.

In a system where agents write code, impossible by construction beats forbidden by discipline. When a rule really matters, I look for the place where it becomes shape: a type, a schema, a permission. A sentence in a README gets lost in a refactor. A type gets enforced on every build.