Keywords for AI agents: what the evidence supports, and the ten we teach

Lists of trigger words for AI agents are circulating: invariant, precondition, falsification, idempotent, verdict, rollback. Each word is said to switch on a hidden mode of the model, and several are credited to famous papers. We checked the papers and the current vendor guidance, then compared the lists with the vocabulary we actually teach at Junyr.

The short version is that these words are useful and not magic. They work when they name something the agent can check, and the ones that guard against runaway loops belong in the harness, where they can be enforced.

Three attributions to check before repeating them

The lists lean on three research papers from 2022 and 2023, and each is credited with something it does not contain. We cite them here only to correct the attribution, not as evidence about how 2026 models behave.

• The optimiser paper from Google DeepMind [1] did find the sentence “Take a deep breath and work on this problem step-by-step.” An optimisation loop found it, at step 107, with one model proposing candidates and another scoring them. It was not a statistical analysis of thousands of phrasings. With PaLM 2-L as scorer on GSM8K it reached 80.2%, against 71.8% for “Let’s think step by step” and 34.0% for an empty instruction. That is one benchmark on one model of 2023.
• The Reflexion paper [2] describes three language models, an Actor, an Evaluator and a Self-Reflection model, with an episodic memory of written reflections. It reports improvements of 22% on ALFWorld (absolute, over 12 iterative steps), 20% on HotPotQA and up to 11% on HumanEval. It describes no special tokens named Evaluate and Reflect.
• The DSPy paper [3] compiles declarative modules and optimises prompts and demonstrations against a metric. Its abstract reports compiled pipelines beating standard few-shot prompting by over 25% with GPT-3.5 and over 65% with llama2-13b-chat. The text contains no <critique>, <plan> or <validation> tags and makes no claim about vague adjectives.

A claim attributed to a paper deserves a page number.

What current evidence and guidance support

Material from 2026 supports a narrower claim than the lists make: instructions work when they state a destination and a checkable criterion, and stopping is secured by evidence rather than by a word.

• Anthropic’s guide for current Claude models [4] recommends general instructions over prescriptive steps (“think thoroughly” often beats a hand-written plan) and explaining why a behaviour matters. It advises dialling back emphatic wording, so that “CRITICAL: You MUST use this tool when…” becomes “Use this tool when…”. It adds that Claude Opus 5 verifies its own work well, and that verification instructions inherited from older prompts can cause over-verification. The sensitivity to the word “think” is documented for Claude Opus 4.5 with extended thinking disabled, where “consider”, “evaluate” or “reason through” are suggested.
• OpenAI’s guide for GPT-5.6 [5] says “Describe the destination rather than prescribing every step”, and reserves absolute words for rules that never bend: “Use ALWAYS, NEVER, must, and only for true invariants such as safety rules, required fields, or actions that should never happen.”
• A preprint on agent termination [6] proposes that an agent may return COMPLETE only when a certificate ties every required claim to valid, in-scope evidence from its own trace. Under controlled termination faults, it produced 0 of 66 premature unsupported terminations in the held-out study, against 40 of 66 for the baseline controller, and 0 of 288 unsafe completions against 252 of 288 in the static study (Figure 1). It certifies support within the recorded trace, not truth, and it comes from a single author.
• A 2026 study of sycophancy [7] varied how prompts are framed. Validation-seeking and emotional-pressure cues often increased agreement, whereas counter-framing and anti-sycophancy prompts tended to reduce it. It tests framings, not a vocabulary of single words.
• A study of expert personas [8] used 1,140 questions, 38 roles and six domains. Role prompting increased the depth of expertise and reduced clarity. Advisory questions in medicine and psychology benefited most, while technical and legal questions did better with straightforward explanations.

None of these sources says that a rare word works as a switch.

The ten keywords we teach

Our training memo of 18 September 2026 [9] reduces the vocabulary to ten words in two families: seven for what to do and three for how hard to try. It came out of two workshops on 11 September, where the prompts that worked best read like an algorithm, used precise vocabulary and named the tools explicitly, and where “verify your sources” worked better than “do not invent”.

The seven action words each name a kind of deliverable:

Keyword	What it asks for
AUDIT	A factual diagnosis of an existing state. It reports the gaps and does not correct them.
EVAL	A comparison of options against given criteria, with an argued recommendation.
INVESTIGATE	A dig into causes across several sources, without stopping at the first plausible explanation.
TEST	A check on a small sample before the full run.
REVIEW	A reread of its own output: list what does not hold, then correct. Ask for it explicitly, because as a standing instruction it ends up skipped.
ALIGN	A document or process brought closer to a given reference.
HYGIENE	A work folder tidied, archived and renamed.

The three effort words set the depth. LIGHT is a quick pass to sort a large volume. DEEP digs into every gap and uses several sources. GOLDEN STANDARD demands full alignment with best practice or a validated reference, and is kept for compliance and reference deliverables. They combine with the action words: a light audit spots the two or three obvious issues, a deep audit documents every gap, a golden standard audit checks full conformity to a reference.

The memo’s example shows the structure: “Deep audit of the stock-tracking file. Input = the last six months of movements. Objective = one deliverable, the list of discrepancies. Before starting, ask the arbitration questions you need. At the end, a critical review of your own output.” It names the source, the volume, a single objective phrased as a deliverable, the effort level, and it closes the loop with a review.

Three tensions with the 2026 guidance are worth stating openly:

• Verification. Anthropic says Claude Opus 5 verifies its own work and that inherited verification instructions can cost tokens for nothing. We ask for REVIEW once, on each important output, rather than as a standing rule. Whether it still adds anything on your model is a question for the test below.
• Capitals. Our material writes the keywords in capitals, while Anthropic advises dialling back emphatic wording. Reading the capitals as the label of a defined word, and not as volume, is a defensible position, and the test below settles it for your model.
• Effort. Our memo reports that the single word DEEP concretely changes the result. That is our field observation, not a measurement, and the sources we checked do not isolate the effect. On current Claude models, how long to think is also an effort setting outside the prompt [4].

Where each word lives: prompt, tool or harness

The words on the circulating lists are real engineering vocabulary, and most of them live in the tool or the harness, where they can be enforced, rather than in the prompt, where they can only be requested. Drawing on the participant debrief of our agentic-processes day on 23 September 2026 [10], we sort them in three layers (Figure 2).

• Prompt: verbs that trigger an action (“plan before acting”, “verify your sources for each figure cited”, “list your assumptions”, “stop if…”) and adjectives that calibrate (reversible, minimal, exhaustive, deterministic). Rules are phrased in the positive, so “you may act if the action is reversible” replaces a double negation that unlocks nothing. Words to avoid are the vague ones (good, correct, honest, “do not lie”) and the ambiguous ones (call, calendar, event, “verify” alone, “existing client”, which became “active client” with cumulative conditions).
• Tool: one tool, one verb, one right. A narrow schema, typed errors and verified provenance make a connector safe, and idempotent is a design property here: repeating the call causes no second effect, so a retry is harmless. This is where the word of the circulating lists finds its proper home.
• Harness: a barrier blocks and is coded outside the prompt, a gate needs a human signature, and a ratchet locks what has been gained. The stop rule is written before launch, edge cases are written as tests before the first run, the journal is the authority, and an audit ends with a written verdict: bounded autonomy, supervised, or clean up first.

A word can ask for a stop. Only the harness can enforce it.

Testing a keyword on your own model

Vendor guidance changes with each model generation, so adopt a keyword only after a small test on the model you use. The protocol below is our recommendation, with sizes given for illustration, and it applies our own TEST keyword to the vocabulary itself (Figure 3).

• Pick 10 to 20 real cases whose outcome can be checked, for example a file where you know the discrepancies.
• Run each case with and without the keyword, on the same model and settings, and repeat the runs because outputs vary.
• Score with criteria fixed beforehand: gaps found, false alarms, tokens used, time taken.
• Keep the keyword only if the score improves, record the model and the date, and replay the test at every model change.

Choose the word you can check

A keyword earns its place when you can say what it changes, when you have tested it on your model, and when the part that matters is enforced outside the prompt. The ten words above are our working set, and they will be revised when the models change.

Sources

1. Chengrun Yang, Xuezhi Wang, Yifeng Lu, Hanxiao Liu, Quoc V. Le, Denny Zhou and Xinyun Chen, ‘Large Language Models as Optimizers’, arXiv:2309.03409, 2023 (ICLR 2024). Cited only to check what it states; outside the freshness window.
2. Noah Shinn, Federico Cassano, Edward Berman, Ashwin Gopinath, Karthik Narasimhan and Shunyu Yao, ‘Reflexion: Language Agents with Verbal Reinforcement Learning’, arXiv:2303.11366, 20 March 2023. Cited only to check what it states; outside the freshness window.
3. Omar Khattab and colleagues, ‘DSPy: Compiling Declarative Language Model Calls into Self-Improving Pipelines’, arXiv:2310.03714, 5 October 2023. Cited only to check what it states; outside the freshness window.
4. Anthropic, Prompting best practices, Claude Developer Platform documentation, undated page, read on 13 October 2026.
5. OpenAI, Prompt guidance for GPT-5.6, API documentation, undated page, read on 13 October 2026.
6. Jason Liu, ‘When May an Agent Stop? Evidence-Carrying Termination for Tool-Using LLMs’, arXiv:2608.23623, 22 August 2026.
7. Lijia Huang, Yao Fu and Sihao Ren, ‘SyPS: Measuring Sycophancy Prompt Sensitivity in Large Language Models’, arXiv:2608.23837, 24 August 2026 (Findings of EMNLP 2026).
8. Shuai Xiao, Su Liu, Weikai Zhou, Jialun Wu, Xinjie He, Zhiyuan Lin and Qiyang Xie, ‘When Does Persona Prompting Actually Help? A Retrieval and Metric Analysis of Expert Role Injection in LLMs’, arXiv:2605.29420, 28 May 2026.
9. Junyr, Tips for better prompting: action and effort keywords, training memo of 18 September 2026 (internal document, not public).
10. Junyr, Participant debrief: agentic enterprise processes, 23 September 2026, v2 reviewed (internal document, not public).

The keywords, the training vocabulary and the observations of effect come from Junyr’s own training memo of 18 September 2026 and participant debrief of 23 September 2026. They describe our practice, and the effect of any single word is a field observation, not a measured result. The 2022 and 2023 papers are cited only to check attributions, not as evidence about 2026 models. The vendor guides are undated pages read on 13 October 2026 and will change. Figure 1 reproduces numbers from the cited preprint, which has a single author and measures support within recorded traces; Figures 2 and 3 are conceptual and carry no data.