Why one developer enforces AI agent limits outside the prompt, not inside it

A developer argues that AI agents with tool access should be treated like untrusted third-party dependencies and contained accordingly. The key rule is that constraints are set when the process starts, since a prompt is only a request that a model can ignore or be manipulated into bypassing. In their agent, the tool list is fixed in advance, allowing twelve read tools while refusing fifteen write tools, so the agent cannot write files or send messages even if it tries. Additional safeguards include an anti-injection section in the prompt, a mandatory adversarial review of outputs, and human approval before anything is published. The author's reasoning is that an agent does what its environment permits, so impossible actions remove the need to trust it.