Why prompt-based rules cannot reliably restrict AI agents

The article argues that telling an AI agent in its prompt to limit data access, such as showing ledger data only to finance, is not a real security control. Prompts are just text the model weighs against other input, so clever questions, long conversations, or hidden instructions in documents can override them. Real protection requires enforcing permissions in code at the tool level, where each call is checked against the caller's identity and grant before it runs. The piece gives an example of prompt injection hidden in a supplier invoice that tries to extract a ledger. It also recommends limiting tool access to what each job actually needs and recording every decision for audit.