If an AI can bypass a rule, that rule does not exist.
So I stopped writing rules as prompts and started writing them as walls: git hooks, file structure, validators. The agent does not decide to follow them. It structurally cannot route around them.
Prompt-based governance is a suggestion. Structural governance is a constraint.
Further reading
- Automate actions with hooks, Claude Code docs. Hooks give “deterministic control: certain actions always happen rather than relying on the LLM to choose to run them.”
- The lethal trifecta for AI agents, Simon Willison. Why no prompt makes an agent safe once it has private data, untrusted content, and a way to send data out.
- CaMeL offers a promising new direction for mitigating prompt injection attacks, Simon Willison, on Google DeepMind’s Defeating Prompt Injections by Design. Security from system design, not from asking the model to behave.
- Design Patterns for Securing LLM Agents against Prompt Injections (Beurer-Kellner et al., 2025), with Simon Willison’s summary. Six patterns that constrain what an agent can do, rather than what it is told.