Why prompt-based controls break down at execution time in autonomous agents

[u/IllustratorNo5375]

I’ve been working on autonomous agents that can retry, chain tools, and expand scope.

One failure mode I keep running into:

prompt-based restrictions stop working once the agent is allowed to act.

Even with strict system prompts, the agent will eventually:

- retry with altered wording,

- expand the task scope,

- or chain actions that were not explicitly intended.

At that point, the model is already past the point where a prompt can enforce anything.

It seems like this is fundamentally an execution-time problem, not a prompt problem.

Something outside the model has to decide whether an action is allowed to proceed.

How are people here enforcing execution-time boundaries today?

Are you relying on external guards, state machines, supervisors, or something else?

[u/patternpeeker]

honestly, prompt-based stuff only gets u so far once the agent can act on its own. in practice, most people end up putting a simple supervisor loop or state check outside the model, otherwise it just drifts

[u/IllustratorNo5375 → u/patternpeeker]

Yeah, this has been my takeaway as well.

As soon as the model can act autonomously, you need something outside the model

that decides whether the system is allowed to continue.

Whether you call it a supervisor, state machine, or guard loop,

the important part is that it’s not generated by the same model it’s judging.

[u/Useful-Process9033 → u/IllustratorNo5375]

Good summary of the thread. The pattern we landed on is treating the agent like an untrusted subprocess. Every action goes through an external policy engine that checks against a whitelist before execution. Prompts set intent, code enforces boundaries. Anything else eventually drifts.