Prompt is a request; code is a limit

The most important rule of this stage: critical rules do not live in the prompt.

Writing “do not mention the child’s address” in the prompt is a request. It is almost always followed, which is why the failure is dangerous: when it happens, no one is watching anymore. All it takes is for the provider to update the model underneath.

A guardrail is the same rule implemented as code that rejects the output. With the request, the violation becomes unlikely. With the guardrail, it becomes impossible.

The same logic applies to access. Least privilege limits the damage when the agent is tricked, and it will be tricked: prompt injection is a structural risk for any agent that reads external content, and no instruction in the prompt solves that. What solves it is ensuring the tricked agent does not have permission to do anything excessive.