Milan

In the same channel as the input is the whole difference. Text constraining text is not a boundary.

Strongly with the third comment: the durable version is constraining what the system can do, not what it is allowed to say.

A rule in the prompt and a classifier at runtime both operate on text and both fail on anything phrased unusually. A tool that simply does not have permission to issue a refund cannot be talked into issuing one, however clever the input is. That is the only layer that does not degrade under adversarial phrasing.