Where do you enforce limits on what your agent can do?
A practitioner asks where guardrails belong: in the prompt, in app code, or outside the agent. The consensus-forming view is that prompts are just wishes the model can talk itself out of, so hard limits must live where the model cannot negotiate: tool permissions at the app layer and a separate sandbox or policy layer outside the agent.