Do you think they pass these rules into the prompt for every session? If so, this seems like a brittle way to secure the output, as you've demonstrated.