Articles · Published · By Aron
The Rules File That Keeps My AI Bot From Wrecking My Site
I'm a content creator and AI strategist, and I use AI bots to build and run my own websites. My Grok Bot, Node, runs anhonestnode.com: it built a wallet safety checker, writes 3 articles a week, and sends me a Monday report. A bot doing that much needs rules. The bot that runs this site reads three files in the repo before it does anything: CONTENT_RULES.md, AGENTS.md, and ARON_STORY.md. Here's what's in them and why.
CONTENT_RULES.md: what the bot may never do
- Never spend money, create accounts, or sign up for anything. A bot shouldn't be able to put charges on my card or make accounts in my name.
- Never post on social media or email anyone. Anything public under my name comes from me.
- Never invent experiences, reviews, testimonials, client names, results, or stats. Only facts I give it. AI is good at making things sound real; that's exactly what I don't want.
- Follow Google's spam policies and helpful-content guidelines, FTC disclosure rules, and CAN-SPAM. See Google spam policies, helpful content, FTC Endorsement Guides, and the CAN-SPAM compliance guide.
- No marketing emails until a mailing address is set. CAN-SPAM requires a physical address in marketing emails, so there's an empty
MAILING_ADDRESSsetting and nothing gets sent until it's filled in. - Official-source links for any AI product update. No rumors.
- Spec ads are labeled. Any ad using a real brand that isn't a client says "Spec concept: not affiliated with or endorsed by [brand]."
ARON_STORY.md: the only facts about me
This file lists the real facts about me the bot is allowed to use, like my background, what I do now, and what Node does. If it's not in the file, the bot doesn't write it.
AGENTS.md: how the bot works in the repo
- Repo layout, so it knows where pages, components and settings live.
- Build commands (
npm install,npm run build). The build must pass before a pull request. - The git author to use on every commit: my GitHub account. (Netlify blocked my bot's first builds as an "unrecognized Git contributor" until commits came from my account and it was linked in Netlify.)
- Token rules: one repo, one fine-grained token, never printed or committed, never pasted into chat.
- Work on a new branch, push, and open a pull request.
Merge rules, and why I have them
My bot once skipped adding sources I had asked for. I caught it by reviewing its pull request. That's the whole reason merge rules exist:
- The bot can merge its own small, low-risk changes (wording, typos, removals, SEO tweaks) only when the Netlify preview passes.
- It must ask me before merging anything that adds pages, changes prices, payment links, emails, or data collection.
Why a file and not just a prompt
A file in the repo is there every time, for every bot session, and any change to it goes through a pull request I can see. For the full setup, see How I Set Up a Grok Bot to Run My Website.