Policy-as-prompt: compiling governance rules into guardrails, and where it stops working
Turning written governance rules into agent guardrails expressed as prompts is an appealing answer to a real compliance problem. It also inherits every weakness of the substrate it is written on.
The appeal is obvious and legitimate. Regulation arrives as natural-language rules, agents are steered by natural-language instructions, and compliance teams can actually read the resulting guardrail — which is more than can be said for most technical controls.
The limit is structural. A guardrail written as a prompt occupies the same token stream as everything else the model reads, with no privilege boundary between them. It is a strong suggestion competing with whatever arrives later in the context window.
That does not make it worthless. Most compliance failures are accidents rather than attacks, and a strong suggestion catches accidents reliably. It makes it unsuitable as the only control, and the literature is clearer about that distinction than most deployments are.
arXiv — Policy-as-prompt: turning AI governance rules into guardrails for AI agents → · Help Net Security — Prompt injection still drives most agentic AI security failures in production → · MDPI Information — Prompt injection attacks in LLMs and AI agent systems →