The permission you can't prompt away

Description and use

<p><strong>Enforcing agent safety in the tool layer, not the system prompt.</strong></p> <p><em>Drawn from a personal agentic system ("Vantage") I built and run daily.</em></p> <p>Most agent "guardrails" are sentences. Somewhere in a system prompt there is a line like <em>"Never delete files without asking"</em> or <em>"Do not send email on the user's behalf."</em> The line is polite, it is well-intentioned, and it is not a control. It is a request addressed to a probabilistic text generator, evaluated anew on every turn, competing with everything else in the context window. The day it loses t

Problem

<p><strong>Enforcing agent safety in the tool layer, not the system prompt.</strong></p> <p><em>Drawn from a personal agentic system ("Vantage") I built and run daily.</em></p> <p>Most agent "guardrails" are sentences. Somewhere in a system prompt there is a line like <em>"Never delete files without asking"</em> or <em>"Do not send email on the user's behalf."</em> The line is polite, it is well-intentioned, and it is not a control. It is a request addressed to a probabilistic text generator, evaluated anew on every turn, competing with everything else in the context window. The day it loses t

Outcome

<p><strong>Enforcing agent safety in the tool layer, not the system prompt.</strong></p> <p><em>Drawn from a personal agentic system ("Vantage") I built and run daily.</em></p> <p>Most agent "guardrails" are sentences. Somewhere in a system prompt there is a line like <em>"Never delete files without asking"</em> or <em>"Do not send email on the user's behalf."</em> The line is polite, it is well-intentioned, and it is not a control. It is a request addressed to a probabilistic text generator, evaluated anew on every turn, competing with everything else in the context window. The day it loses t

Evidence

The permission you can't prompt away

Source