AI Agents Need Boundaries, Not Better Prompts

When an agent behaves badly, the first response is often to expand its system prompt: another rule, a firmer prohibition, more business context. This can improve behaviour, but it is not a security or reliability boundary.

A prompt influences a probabilistic decision. A boundary determines what actions are possible.

Constrain capability at the tool layer

An agent that needs to reschedule a delivery should not receive a general-purpose database client. Give it a narrow operation with typed inputs, explicit authorisation and business validation.

await delivery.reschedule({
  deliveryId,
  requestedDate,
  reason,
  approvedBy: user.id,
})

The operation should reject invalid dates, inaccessible deliveries and changes that require additional approval. The model can propose arguments; deterministic code decides whether they are acceptable.

Separate planning from execution

Let the agent assemble a plan before creating side effects. The plan becomes inspectable input to policy checks, user confirmation and cost controls. For consequential work, execute one bounded step at a time and evaluate the result before continuing.

This also makes recovery possible. If the fifth step fails, the system should know which four actions occurred, which can be reversed and who owns the exception. A conversational transcript is not an adequate transaction log.

Design for containment

Use least-privilege identities, short-lived credentials, rate limits, idempotency keys and explicit resource scopes. Distinguish read tools from write tools. Require confirmation at the point where a reversible suggestion becomes an irreversible action.

Prompts remain useful for intent, tone and reasoning conventions. They are part of the design, just not the part that should protect money, customer records or production infrastructure.

The test is not whether the agent usually obeys. It is what the surrounding system allows on the occasion that it does not. Dangerous behaviour should be difficult, visible and containable by design.