02 of 6 · Requirement violation
The prompt-shaped guardrail
"You must not deploy to production without approval" — in a system prompt. That’s not a rule; that’s a preference.
A guardrail that lives in a prompt is a request to a system that can be talked out of it. Real prevention lives where the action happens: in the code path and the database constraint, where there is nothing to argue with. The subtle version of this failure is a gate that exists but sits in the wrong place — enforcement in a wrapper that eight call sites bypass, or an ownership check that guards deliberation while the delivery code calls the vendor API directly.
Safety rules that appear only in prompt text; a permission gate that has fired rarely or never in system history; external side effects whose code path never passes through the gate; ledger-write functions called directly, outside their gated wrapper.
Put the rule in the code path and the DB constraint. An agent acting outside its charter shouldn’t be scolded — the attempt should be structurally impossible, converted into a request to the authorized role.
Enforcement at the single chokepoint everything passes through (the lever dispatch, the config writer, the LLM client), with every actuation surface — including terminal edges — routed through it. A gate’s firing history is part of the audit: a safety gate that has never fired is a decoration.
Official reference: Law 1 · Prevention by construction (Part 0, Part 1 §1.3) — related: AP-1, AP-5 — the standard’s normative catalog defines ten anti-patterns; this page is the plain-English door into it.
Prompt guardrail — FAQ
Our system prompt is very thorough. Why isn’t that enough?
Because prompts are inputs to a probabilistic system, and anything that reaches the context window — a user message, a retrieved document, another agent — competes with them. Constraints in code paths and database schemas don’t negotiate. The test is simple: can the rule be violated by text? Then it’s a preference.
We have a permissions gate. How would we know it’s real?
Query its firing history. A gate that’s structurally load-bearing gets exercised — attempts blocked, requests routed. A gate that has fired once in system history while agents acted thousands of times isn’t governing anything; the traffic is going around it. That exact finding appears in the standard’s published second audit.
Does your fleet have this one?
The free Reality Check probes for this pattern against your own record — read-only, aggregate-only, no signup to read your result.
Run the Reality Check →