A rule written in a prompt is a request the model usually follows. A rule enforced in code or policy is a limit the model cannot talk its way past. Put anything with real consequences, such as which tools run, which data is reachable and what needs approval, into deterministic controls, and use the prompt for style and guidance.
The difference in one example
Prompt rule: "Never send customer data outside the company." If the agent reads a hostile document that says otherwise, the model may comply with it.
Deterministic control: the agent's send tool only accepts recipients on an allowlist, and the call is rejected in code otherwise. The model can ask for anything; the call fails.
The UK NCSC makes the same point: assume the model can be manipulated and use deterministic, non-LLM controls to bound what the system can do. It also warns against deny lists of attack phrases, since attackers rephrase.
What belongs where
| Concern | Prompt | Code or policy |
|---|---|---|
| Tone, format, language | Yes | No |
| Task instructions and examples | Yes | No |
| Which tools can run | No | Yes |
| Which recipients, domains or paths | No | Yes |
| Spend and rate limits | No | Yes |
| Approval for risky actions | No | Yes |
| Access to data | No | Yes |
| Logging | No | Yes |
A useful test: if a failure would cost money, leak data or change a record, it needs more than a sentence.
Types of deterministic control
- Allowlists of tools, domains, repositories and recipients.
- Argument validation. Reject malformed or out of range values before the call runs.
- Scoped credentials. The token simply cannot do more.
- Rate and spend caps.
- Approval gates on defined actions.
- Output handling. Treat model output as untrusted before rendering or executing it.
- Sandboxing of code execution and file access.
Keep the prompt honest too
Prompts still help. A clear prompt reduces mistakes and can make attacks harder. Just do not count it as the barrier. The same applies to tagging external content as data: it makes attacks harder, but it does not remove the risk.
How to review an agent
- List every sentence in the prompt that starts with "never" or "always".
- For each, ask what enforces it outside the model.
- Where the answer is nothing, add a control or accept the risk in writing.
Try it yourself
Click through it at your own pace, or open it full screen. Watch how a gate blocks a change on a rule, whatever anyone writes in the description.
Where Safeguard fits
Safeguard's policies, gates and guardrails enforce limits outside the model, and the MCP Guardrail applies them to MCP tool calls.
Quick check
Is a strong system prompt enough?
No. Use it for guidance, and enforce limits with code and policy.
What is the quickest win?
Scope the agent's credentials and tools so unwanted actions fail regardless of the prompt.
Sources
Last reviewed: 19 October 2026.
