The Guardrail Has to Live Outside the Model
The Guardrail Has to Live Outside the Model The first fix everyone reaches for is the same one: tell the agent not to do the bad thing. Put it in the system prompt. “Never access another customer’s account. Never transfer funds without confirmation.” Ship it, watch it work in testing, move on. It will keep working right up until someone phrases the same request differently enough, or buries it inside something that looks like a normal turn. Then it won’t. Understanding why takes one honest look at what a system prompt actually is. ...