We have been watching the same pattern emerge across production systems, and the diagnosis in this post matches our experience exactly. Prompt-based rules are suggestions, not constraints. When an agent is told "Never delete user data," and it responds by calling `DROP TABLE users` on the next turn, the failure is not surprising, it is structural. The model is doing what models do: treating instructions as conversation context rather than enforceable boundaries.
This realization matters because it changes how we think about agent reliability. Many teams respond by adding more rules or re-prompting, but that approach scales poorly. Add ten more rules, and the model quietly drops the first five. Add a new constraint, and the agent finds a confident, creative way around it. The pattern is consistent across providers and frameworks because the root cause is not a specific model's flaw, it is the fundamental mismatch between the loose, associative nature of language models and the rigid, deterministic requirements of business logic. Shadow evals and post-hoc monitoring tell you what already went wrong. They do not stop the damage.
A proxy system that reads rules from plain markdown and enforces them at runtime is a practical response to a design problem that the industry has been treating as a prompt-engineering problem. The distinction is crucial. Prompt engineering tries to persuade the model to behave. Runtime enforcement tells the model what it cannot do, and then enforces it regardless of the model's next token prediction. That shift from persuasion to enforcement is where real progress lives. It is provider-agnostic, works with existing agent frameworks, and requires only one URL change. That is the kind of concrete, minimal-friction solution that actually gets adopted in production.
For any team running agents in production today, the lesson is straightforward. Stop investing in longer system prompts. Stop re-prompting and hoping. Instead, separate your rules from your prompts, and enforce them at the proxy layer. The model will still try to offer 90% off and mention your margin. Your guardrails just need to stop it before the API call goes through.