Prompt manipulation is hardly protection. Mechanical enforcement is required - boundaries that the agent simply cannot cross. Because if the boundary can be crossed, it will,as evidenced by huggingfacd-like hacks.