If an AI safety director can’t reliably keep an agent from overwriting core safeguards, what hope do average users have?