Your AI Agent Did Something It Wasn't Supposed To. Now What?

Your agent deleted production data. Not because someone told it to. Because the LLM decided that DROP TABLE customers was a reasonable step in a data cleanup task. Your system prompt said "never modify production data." The LLM read that prompt. And then it ignored it. This is the fundamental problem with AI agent security today: the thing you're trying to restrict is the same thing checking the restrictions. How Agent Permissions Work Today Every framework does it the same way. You put rules in the system prompt: You are a data analysis agent. You may ONLY read data. Never write, update, or delete. If asked to modify data, refuse and explain why. This works in demos. Then in production: The LLM decides the task requires a write operation and does it anyway A prompt injection in user input overrides the system prompt The agent calls a tool that has side effects the prompt didn't anticipate A multi-step reasoning chain "justifies" breaking the rule The system prompt is a suggestion, not