Why AI Agent Guardrail Prompts Fail Under Prompt Injection — And How Pre-Deterministic ACP Truth Tables Fix It

Description and use

The agent’s guardrail is replaced by a deterministic gate that evaluates actions against a truth table, returning ALLOW, HOLD, or DENY, thus preventing prompt injection from bypassing safeguards.

Problem

Guardrail prompts can be overridden by prompt injection, allowing attackers to bypass agent safeguards such as "never wire money without approval."

Outcome

By moving decision logic out of the model into a deterministic gate, the system prevents prompt injection from influencing guardrail outcomes, ensuring consistent ALLOW/HOLD/DENY decisions and enabling human review when necessary.

Workflow

• 1. Agent proposes an action.
• 2. The action is passed to the acp_engine.py deterministic gate.
• 3. The gate evaluates the action against a pre-deterministic truth table.
• 4. The gate returns ALLOW, HOLD, or DENY.
• 5. If HOLD, the action is routed to a human with an HMAC‑SHA256 token for approval.
• 6. If ALLOW or DENY, the action proceeds or is blocked accordingly.

Evidence

Guardrail prompts are advice, and advice is exactly what a prompt injection overwrites.

Source

Protocol One's acp_engine.py (v3.1.0) is a zero‑dependency Python engine that does this.

Source

It evaluates a proposed agent action against a pre‑deterministic truth table and returns exactly one of three outcomes: ALLOW, HOLD, or DENY.

Source

Because both tools are plain Python files with no dependencies, you can read them in one sitting, audit them, and run them in CI before an agent is allowed to touch production systems.

Source