Teams building agents ask what guardrails to put in the system prompt. The research keeps returning the same answer: the prompt is the one place safety cannot survive.

In April 2025 a team of researchers evaded six commercial guardrail detectors - Azure Prompt Shield, Meta Prompt Guard, NeMo Guard, ProtectAI, and Vijil - with up to 100% success (arXiv:2504.11168). The attacks were character tricks: homoglyphs, zero-width characters, emoji smuggling, unicode tags, and bidirectional text. Models built to block harmful prompts missed harmful prompts written in a slightly different alphabet.

A dedicated detector model runs outside the agent's context and still loses. A sentence in the system prompt fails worse, because it runs inside the context it is supposed to police.

The agent is the adversarial surface

The agent's context is the adversarial surface. A guardrail inside it is just more context: the model reads the rule and the untrusted data in the same pass, unable to tell them apart. Both are tokens competing for the same next-word distribution, and the data usually wins. Every safety sentence is another token an attacker can pattern-match, which is why evasion research disguises the harmful request rather than overpowering the rule.

Injection arrives through the same channel: a tool output, a retrieved document, or a webhook body can carry instructions. An injected "ignore your previous instructions" edits the page the rule is written on, from within. Character tricks work because the line between "instruction" and "data" is a convention the model maintains, not a mechanism it enforces.

Enforcement that survives adversarial input sits outside the model's context, at a point the agent cannot reach, with rules it cannot rewrite: the governance boundary.

The limits of a prompt-level guardrail

Self-reporting is unreliable. An agent that violates a rule does not raise its hand. Asking it to report its own failure is a principal-agent problem: the constrained party does the reporting. Boundary controls evaluate the output instead, so they never need the agent to tell the truth.

The author of the limits is the author of the agent. When one configuration both defines and constrains an agent, anyone who can edit the agent can edit its limits. Platform and security teams need to govern agents they did not write, which only works when the limits live outside the governed thing.

Determinism. A guardrail that is "more prompt" inherits the model's nondeterminism: the same rule can hold one run and slip the next. Hard guarantees come from regex, schema checks, and deny-lists - code, not vibes. A regex either matches or it does not, every run. That is Modulo's deterministic gates: the gate evaluates the output, passes or fails, and the run proceeds or pauses, with nothing depending on the agent cooperating.

Auditability. A regulator asks what the control did on this run. A prompt cannot answer: there is no record of a rule being obeyed, only the model's output afterward. A boundary gate has a record - it evaluated, it decided, and the decision is written to an immutable audit trail. "Prompt refused" is a hope; "Gate blocked output X for reason Y" is evidence.

The honest boundary

The agent definition is the driver's manual: what tools the agent has, the task, the output format. The manual describes behavior; the road enforces it.

The boundary acts where the governance layer mediates: output passes through gates before it moves anywhere, and human review happens against gate evidence, not the agent's word. Where the layer does not mediate, it does not pretend a speed bump exists. An external agent runtime writes files directly, and the boundary cannot inspect every write, so it checks the driver's license before the car starts, refusing to run an agent whose declared capabilities violate policy, and records what it allowed and blocked. It does not claim a control where none can exist.

What this means for buyers

Demand three things from any agent platform. Guardrails: what the agent must not do, enforced at the boundary, not the prompt. Permissions: what the agent may do, scoped to specific capabilities, not blanket write access. Auditability: what the agent actually did, recorded without its cooperation. Together they let a platform answer for a run after the fact, as a matter of record.

Modulo ships this: input-side guardrails are evaluated at run creation, before the input payload is persisted. They are deterministic - regex or JSON Schema only, no LLM judge on the input side - with observe, warn, block, or redact actions. A block is terminal, with no HITL gate. Remediation is the guardrail-override endpoint, which re-runs the guardrail pass on the operator-supplied input rather than resuming on the blocked payload.

The EU AI Act and the NIST AI Risk Management Framework ask for evidence of control effectiveness, not the presence of controls. A prompt full of rules is a control on paper; a gate that blocks a bad output and logs the decision is evidence. Buyers should ask the effectiveness question: the research measured a control that existed and was still evaded. Ask a vendor whether their boundary controls have been tested against character-level evasion.

A control that detects and records but does not stop is worse than none, because it creates the impression of protection. State what a control covers and what it does not: an output gate for leaked secrets can say that, but it cannot claim to stop a malicious agent from acting. Coverage you can state is coverage you can verify, and verification is what the trust question is about.