If you're relying on a prompt to constrain agent behavior, you've already lost.