Policy-as-prompt: turning governance rules into guardrails, and where that breaks
A line of work proposes compiling governance rules directly into agent guardrails — policy expressed as prompt. It is an appealing answer to a real compliance problem, and it inherits every weakness of the substrate it is written on.
The appeal is obvious. Regulation arrives as natural-language rules, agents are steered by natural-language instructions, and translating one into the other looks like a short path from obligation to enforcement. Compliance teams can read the guardrail, which is more than can be said for most controls.
The problem is the one OWASP keeps restating. A guardrail written as a prompt sits in the same token stream as everything else the model reads, with no privilege boundary between them. A policy expressed that way is a strong suggestion competing with whatever arrives later in the context.
Which does not make the approach worthless — a strong suggestion catches accidents, and most compliance failures are accidents. It makes it unsuitable as the only control, and the literature is clearer about that distinction than most deployments are.
arXiv — Policy-as-prompt: turning AI governance rules into guardrails for AI agents → · arXiv — Parallax: why AI agents that think must never act → · Infosecurity Magazine — Prompt injection remains unsolved, OWASP researcher warns →