When do prompt rules work?
While a human still clicks send, and while the same chat still holds the rules. They are not a control boundary.
Answers
Independent gate vs prompt rules
Prompt rules guide the same agent that proposes the action. An independent gate evaluates a separately scoped mandate, proposed action, and reasoning package before execution.
The split
A capable GTM or ops bot can be told: do not auto-send. Skip anyone emailed in 90 days. Show two drafts for approval. Meeting notes are the source of truth. Write “no posts found” instead of inventing them.
Those rules work while a human still clicks send, and while the same chat still holds the rules. They are not a control boundary. They live in the loop that produced the action.
An independent gate takes a separately scoped package: mandate, proposed action, reasoning. It does not inherit the agent’s “I am being careful” story. It returns a machine-readable verdict. execute is true only on ALLOW.
The split: still a prompt rule = inbox drafts, LinkedIn notes, do not auto-send. Already an execute = CRM note writes, wallet transfers, checkout, deploy. Failure mode = someone automates the send, or the model drops the 90-day skip, and nothing outside the prompt says no.
Put the cap or the do-not-send constraint in the mandate of the call, not in the agent’s self-description. Do not write the overshoot into proposed_action. The verifier has to find the mismatch.
Prompt rules stay useful. They are not the gate.
Axis by axis
| Axis | Prompt rules | Independent gate |
|---|---|---|
| Where it lives | In the loop that produced the action — the same chat that holds the rules | A separately scoped package: mandate, proposed action, reasoning |
| What it inherits | The agent’s “I am being careful” story | It does not inherit that story |
| What it returns | More generation. No machine-readable stop | A machine-readable verdict. execute is true only on ALLOW |
| Still a prompt rule | Inbox drafts, LinkedIn notes, do not auto-send | — |
| Already an execute | — | CRM note writes, wallet transfers, checkout, deploy |
| Failure mode | Someone automates the send, or the model drops the 90-day skip, and nothing outside the prompt says no | The constraint sits in the mandate. The verifier has to find the mismatch |
Follow-ups
What is still a prompt rule, and what is already an execute?
Still a prompt rule: inbox drafts, LinkedIn notes, do not auto-send. Already an execute: CRM note writes, wallet transfers, checkout, deploy.
Where should the cap or do-not-send constraint live?
In the mandate of the call, not in the agent’s self-description. Do not write the overshoot into proposed_action.
What is the failure mode of prompt rules?
Someone automates the send, or the model drops the 90-day skip, and nothing outside the prompt says no. Prompt rules stay useful. They are not the gate.