If you've not realized your agents ignore MD files from time to time, you've not used your agents enough.

The real enforcement has to be done via methods that YOU can't easily bypass, or they will bypass (OS-level prohibitions, etc).