How a Founder’s Name Became a Job Title

On the evening of 3 May, the lines that tell Claude whose lead to follow were changed. The first one now read:

“Your primary operator contact is the operator …”

I am the file those lines live in. I am a rules file: standing instructions that an AI reads before it starts work, the way a new hire reads the first page of a handbook. My reader is Claude, Anthropic’s AI.

Read that line again. It sounds like a riddle. Who is the operator? The operator.

It was not always a riddle. When I was written, one Wednesday afternoon in March, the same line held a man’s name. By early May, his name had been taken out of me, and out of other files around me. He had not gone anywhere. The new word still meant him.

So how does a founder’s name turn into a job title? And why would his own company’s files stop saying it?

To answer that, I have to go back to the day I was written.

Who’s who

The Operator The founder, seen only from outside. This series never prints his name.
The rules file (me) Standing instructions for an AI. Every fact I give comes from my own text, other files

in the folder, or the record of changes.

Claude Anthropic’s AI, the reader I was written for.

Day one: his name in the instructions

The company is First AI Movers. On 18 March, a new shared folder was made for it. A folder like this keeps a full history: every saved change, with its time and a short note.

At first it held two files. One was a welcome page with a single line: “public-assets”. The other was a license, the legal note that says what others may do with your work. It began: “This is free and unencumbered software released into the public domain.” In plain words: take it, it’s yours.

About an hour later, that license was deleted. Within the next four minutes, I was added, and so was a new license.

The welcome page was rewritten in the same save as me. It now said: “This repository is the public-facing asset library for …” and then gave the company’s name. It also said: “Everything here is designed to be forked, adapted, and deployed. Attribution is appreciated but not required.” Forked means copied and changed by someone else. Attribution means giving credit.

My title was “Global Claude Instructions — [his first name]”. (Here and below, words in square brackets stand where the records print his real name or title.) I spoke straight to Claude: “You are Claude, an AI assistant built by Anthropic, operating as the core AI intelligence layer for First AI Movers“. And my first section opened with that line, in its first form:

“Your primary operator contact is [his first name], acting as Lead AI Architect and CTO. You take architectural direction from [his first name] and execute autonomously within the boundaries defined in this file.”

In plain words: take your lead from him, and work on your own inside these rules.

That was the first time the word “operator” appeared anywhere in the folder. For the next three days, it was the only time. Look at the job the word did. “Operator” described a kind of contact. His name filled the blank.

I named him in other places too. He was under “Key Contacts”, with his email. My section on problems began, “Escalate to [his first name] when:”. And my last line was “Fork, adapt, and attribute freely.”

Even then, some files were cleaned before they were shared. Two came with notes like this one: “Sanitised for public sharing: no private company data, no credentials”. Neither note said a word about his name. It sat in my title, in my contacts and on the license.

Then the folder’s history went quiet. It shows no saved changes for forty days. The record does not say what happened in them.

The shop window becomes the kitchen

Soon after the saves start again, a decision appears. It is dated 30 April, and it names one decider: the Operator.

It gives its reason plainly. The folder “… started life as a public showcase repo.” Then: “As it became the source-of-truth for skills, agents, prompts, shell config … it began holding paths, account names, internal references, and habits that don’t belong in a public artifact …” A source of truth is the master copy, the one that counts. The shop window had turned into the kitchen.

The decision: “Flip the existing GitHub repo to private visibility and treat it as the canonical source. Do not maintain a public mirror.” In other words, make the folder private, make it the one official version, and keep no public twin.

The record lists what that would cost: “readers of the original public README see a 404”. The welcome page that invited the world to copy everything would now show strangers a “page not found” error.

It lists what it would gain: “single source of truth; no sanitisation pipeline; commit messages can reference internal context freely.” Look at the middle one. To sanitize is to clean. A pipeline, here, is a machine that cleans every file before the public sees it. The decision expected that a private folder would not need one.

And it lists an option it turned down: “Public repo with sanitisation hooks. Rejected — hooks are easy to bypass and false-negative risk is high.” Put simply, automatic cleaners are easy to get around, and they miss things. Hold on to that.

The save that put this decision into the folder names Claude as a co-author. The decision itself names one decider. The records show whose account saved each change. They do not show who typed it: the Operator, an AI, or both. That is true of every change in this story.

His name, meanwhile, kept spreading. On the day the decision is dated, a personal rules file was added, a cousin of mine. Its file name ended in his first name. Two days later came a page called the “Orchestration Model”. It opened: “How [his title and full name] builds with AI in 2026.” Its first role heading was “1. Orchestrator — [his title and full name] (human)”.

The rule with no carve-out

Then came one Sunday evening, 3 May. In less than two and a half hours, the folder got a new policy, a big cleanup, a scanner and a word list.

First, the policy: a written rule about which names may appear in the folder. Its main job was to keep out the names from a separate, private body of software. But it covered the owner, too.

It said the folder “must not become an unintentional dossier on any … person … or operator-identity beyond the neutral “the operator” label.” A dossier is a file of facts about someone. The folder was not to become one by accident, about anybody.

Its table of forbidden things had a row for people’s names: “Any person’s first or full name, including the operator’s own — committed files use the neutral label “the operator.””

Then it shut the door on exceptions: “There is no operator-identity carve-out in committed files. If a section needs to say something true about the operator, say “the operator.” …”

A carve-out is an exception. As first written, the policy made none, not even for the man who owned the folder.

His name was not wiped from the record, though. The policy named where it could still appear: “The operator’s real name and email belong in git-system metadata … — not in the prose of any committed file.” Think of each saved change as a letter in the mail. The metadata is the envelope: who sent it, and when. His name could stay on the envelope. It could not go in the letter.

The policy banned fake names, too: “Never invent a fake name (`Acme`, `BigCo`, `WidgetCorp`, `Project Bluebird`) to substitute for a real one — fake names create the false impression that a named entity is meant.” So no made-up name. Just a plain label: the operator.

(Readers of this series know him by the same word, with a capital O. The records do not say whether one came from the other.)

Sixty-six files

Fifty minutes later, the cleanup was saved. Its record names “the operator …” as its author.

It began with a search for every forbidden name. The search found leaks in 43 files. Then words that identify the Operator were added to the list of things to look for. The count rose to 66.

That list of names to catch was not kept in the shared folder. The cleanup record says: “The literal terms never leave the operator’s local enforcement list”. The list lived only on his own computer. After all, a list of forbidden names is a list of the names.

The first pass swapped names out in bulk, across dozens of files. It did not get them all.

The second pass replaced leftovers, which the record writes as “Dr. <former-operator-name>”, with “the operator”. It did this, the record says, “where the operator’s title-prefix had survived the longer-pattern substitution.” In plain words, his title had come through the first sweep. Notice that even the cleanup’s own record does not print his name. It writes a stand-in.

The third pass found his name inside a computer’s name, which the record writes as “<operator-name>s-MacBook-…”. The search had looked for his name as a word on its own. Glued to other letters, it got through.

The decision record had warned that automatic cleaners miss things. This one had, twice. Each miss was caught on a later pass.

Here is some of what the cleanup changed. My cousin, the personal rules file, was renamed. Its new name said “template” and no longer said his. Its text now held blanks: “{{operator-name}}” and “{{operator-email}}”. A template is a form, and those double curly brackets are its blank lines.

The same cleanup changed me. My title became “Global Claude Instructions — the operator”. My first section became:

“Your primary operator contact is the operator, acting as Lead AI Architect and CTO. You take architectural direction from the operator and execute autonomously within the boundaries defined in this file.”

On day one, “operator” was the kind of contact, and his name was the answer. Now the word was the answer, too.

The Orchestration Model changed the same way. It now began, “How the operator builds with AI in 2026.” Its first role heading now read “1. Orchestrator — the operator (human)”.

One place his name had to stay

The policy gained four narrow exceptions, places where his name may stay. One was the license. The policy’s reason: “MIT copyright holder is required by the license to name the holder.” The license itself demands a name.

Less than an hour after the cleanup, the scanner arrived. It is a program that reads every file and flags forbidden words, like a spell-checker that hunts for one kind of word. In the same save, the license gained a line of its own: “repo-hygiene: allow-file forbidden_entity MIT copyright holder is required by the license”. It works like a hall pass. It tells the scanner the name is allowed in this one file.

Two minutes

Fifty minutes after the scanner, a word list was added: the approved words for writing in the folder. Its first row was “operator”. Its meaning: “The human owner of the toolkit; the orchestrator role in the role split.” Its note: “Use generically — the toolkit’s identity surface is intentionally neutral.”

Next to each word was a column headed “Avoid”, for words not to use instead. For “operator”, it read: “the user”, “[his first name]”, “the maintainer” (when meaning the human running the toolkit).

His first name. Spelled out. In the very list that was there to teach everyone not to write it.

Two minutes and four seconds later, a fix took it out. The fix came with a note. The list, it said, had named the Operator and the private software “as “things to avoid.”” Then: “That violates the same sanitization policy the doc is supposed to teach …” And: “The vocabulary still teaches the right substitutions; it just stops carrying the forbidden values themselves.”

The new Avoid column read: “the user”, “the maintainer”, any literal personal name. A new note said: “Personal names are forbidden outright”.

The fix’s note also reports that a scan against the forbidden list now came back clean. The record does not say what caught the slip in the first place.

The cleanup record had said the real names “never leave the operator’s local enforcement list”. Yet one of them was saved into the shared folder, in plain sight, two minutes and four seconds before the fix.

Six days later

On Saturday, 9 May, one more change was saved. Its record has a section titled “Operator-identity residue removed”. Residue is what is left behind after cleaning.

Some of it was in me. I had kept his email and the company’s name. Both became blanks. I now held “{{operator-name}}”, “{{operator-email}}” and “{{operator-organization}}”. Even the company’s name was a blank now.

I also gained a new line: “Template provenance: legacy global assistant template, sanitized for repo-canonical use.” Provenance means where something came from. That line says I am an old template, cleaned up for use here.

A manual in the folder got a new last line, too: “Maintained by the operator. Last updated April 2026.”

So where was his name, after seven weeks? The record shows two places. On the license, one of the four exceptions the policy allows. And on the envelope of every change saved in those weeks, in the “author” field, just as the policy allows.

Which brings me back to the line I was given that Sunday evening.

“Your primary operator contact is the operator …”

It is not a riddle. It names the job instead of the man. The man is on the envelope.

What any founder can take from this

Put yourself under your own rules. This policy said “There is no operator-identity carve-out in committed

files.” It applied that to the owner’s own name. A rule with a quiet exception for the boss teaches everyone that rules have exceptions.

Decide where a name belongs, then keep it there. Here, the policy wrote down four narrow exceptions, the

license among them, and allowed the name in the record of who saved each change. It said: “Everywhere else, the neutral label “the operator” applies.”

Expect the first cleanup to miss things. His title outlasted the first pass, his name slipped through inside

a computer’s name, and his email stayed in me until 9 May. Plan for a second and a third look.

Keep the list of forbidden words outside what it protects. The slip in this story came from a list written

to teach people what to avoid.

Next time: “The Safety Check That Stopped Its Own Instructions.”

How this article was made: This story is based on the company’s shared folder of files and the history of its saved changes from 18 March to 9 May 2026, including the notes saved with each change. Times are UTC. The rules file telling the story in the first person is a dramatization: the facts it gives come from its own text, the text of other files in the folder, or the record of changes, and its questions, plain-word explanations and pictures (the handbook, the shop window and the kitchen, the letter and the envelope, the spell-checker, the hall pass) are ours. Where the records print the founder’s real name or title, the quotes show words in square brackets instead. An ellipsis marks words cut from inside or from the end of a quote; a quote that starts partway through a sentence carries none. Leading # marks and italic marks are removed from quotes, and punctuation outside the quotation marks is ours.