Topic starter
06/11/2026 6:39 pm
TL;DR: System prompts cannot reliably stop an AI agent from making risky tool calls once it holds live credentials, because untrusted content in context can outweigh policy text, according to Skyrelis. The control that matters is deterministic enforcement at the tool boundary, where each action can be allowed, blocked or escalated before execution.
Editorial analysis by NHI Mgmt Group, based on content published by Skyrelis: “Your Agent Read the Policy. It Doesn't Have to Follow It.”.
Key questions
Q: What signs suggest an AI agent needs runtime enforcement?
A: An AI agent needs runtime enforcement when its tool use, data access, or action scope can drift beyond the authorised task, especially if it can create tickets, move money, change records, or call internal APIs.
Q: Why do native guardrails fail against prompt injection in AI agents?
A: Native guardrails often classify text rather than control execution, so they can miss attacks that manipulate the agent’s next action instead of its visible output.
Q: When should teams prioritise human approval over agent autonomy?
A: Human approval should take priority when the agent is about to perform irreversible, high-impact, or privilege-bearing actions, such as releasing payments, granting access, deleting records, or changing security settings.
Practitioner guidance
- Map every agent tool path Inventory each tool, API and data source an agent can reach, then flag irreversible, financial and cross-tenant actions for separate policy handling.
- Move enforcement outside the model Place allow, block and escalation logic at the tool or API boundary so the decision happens before the request reaches the target system.
- Start in observe mode Log decisions without blocking first, then tune thresholds from real agent behaviour before turning on enforcement for high-risk calls.
Bottom line: AI agents with live credentials can bypass prompt-level intent because the model processes policy and untrusted instructions in the same context.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/11/2026 6:41 pm
Prompt policy is not an access control: A system prompt can describe a limit, but it cannot enforce one once the agent can call live tools. That assumption was designed for human-paced review and model compliance, not for runtime action selection under mixed context. The implication is that agent governance has to be defined at the moment of execution, not at the moment of instruction.
A few things that frame the scale:
- 69% of security leaders agree identity management must fundamentally shift to address agentic AI systems, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: When should teams prioritise human approval over agent autonomy?
A: Human approval should take priority when the agent is about to perform irreversible, high-impact, or privilege-bearing actions, such as releasing payments, granting access, deleting records, or changing security settings. Human review creates a control point for exceptions, sensitive context, and accountability when the agent cannot safely act on its own.
👉 Read our full editorial: Prompt guardrails fail when AI agents hold live credentials