Anti-Patterns: Teaching AI Agents What NOT to Do

Most teams train their AI agent's routing with positive examples: here are 30 ways users ask to create a task, here are 25 ways they ask for a status report. Then production arrives and the agent creates a task when someone mentions a task, sends a follow-up when someone says they already followed up, and drafts a reply to a message that was just an FYI.

The missing ingredient is anti-patterns: explicit examples of inputs that look like an action but must not trigger it. In our production routing — 30 actions, 95% accuracy — anti-patterns did more to cut false positives than any threshold tuning or prompt engineering.

Why False Positives Are the Expensive Failure

A false negative (the agent misses a request) costs a retry — the user rephrases and moves on. A false positive (the agent acts when it shouldn't) costs trust. An unwanted proposal in the approval queue is annoying; an unwanted auto-executed action is a story people tell about why the AI can't be trusted. Optimizing recall while ignoring precision optimizes for the demo, not the deployment.

The Shape of the Problem

False positives cluster into recognizable families. From our misroute reviews:

Embedding similarity is nearly blind to these distinctions — "send the invoice" and "I sent the invoice" sit almost on top of each other in vector space. That's exactly why anti-patterns must be explicit examples, not a hope that the model notices tense.

How We Encode Anti-Patterns

1. Per-action negative sets. Every action in the catalog carries not just positive phrasings but 10–20 near-miss negatives. The verification model sees both: "these match, these deliberately don't."
2. Contrastive pairs. The strongest negatives are minimal pairs — the same sentence with one changed word that flips the meaning. We write them in pairs on purpose.
3. Confidence penalties, not bans. Matching an anti-pattern doesn't hard-block the action; it drops confidence out of the execute tier (0.9+) into the clarify tier (0.7–0.89). The agent asks "do you want me to send this, or are you telling me it's done?" instead of silently guessing either way.
4. Global anti-patterns. Some rules apply catalog-wide: quoted text inside forwarded emails is not an instruction, questions about the agent's capabilities are not requests to act, messages addressed to someone else are not commands.

Every rejected proposal in the approval queue is a free anti-pattern. The user already labeled it for you — the only failure is not harvesting it.

The Harvesting Loop

Anti-patterns aren't designed upfront; they're collected. Our loop, running weekly:

• Pull all rejected proposals and all misroutes flagged by users
• Classify each into a false-positive family (tense, question, negation, and so on)
• Add the real message — lightly anonymized — as a negative example on the action it wrongly matched
• If a family recurs across many actions, promote it to a global anti-pattern
• Re-run the routing evaluation set to confirm no positive examples broke

That last step matters. Anti-patterns can overcorrect: add enough "did John email..." negatives and the agent starts refusing legitimate "email John..." requests. Keep a fixed evaluation set of a few hundred labeled messages and require both precision and recall to hold on every change.

Results to Expect

On our system, systematic anti-pattern harvesting over roughly two months cut false-positive proposals by more than half while routing accuracy held at 95%. Better still, the failures that remained moved from silent wrong-actions into the clarify tier — visible, cheap, recoverable.

Teaching an agent what to do gets it to the demo. Teaching it what to leave alone is what gets it to production. Budget your example-writing accordingly: for every action, the negatives deserve as much care as the positives.