Stop telling the model no. Take the capability away.

Every team putting an LLM in front of customers eventually asks the same question: how do we stop it saying something we cannot stand behind?

The instinct that does not work

The first attempt is almost always a longer prompt. "Never promise a delivery date." "Do not quote prices." Each new failure adds a line, the prompt grows to two pages, and the model still occasionally does the thing.

Prompt instructions are guidance, not enforcement. A sufficiently unusual conversation will find a path around them, and you will not know until a customer screenshots it.

Remove the capability instead

The reliable version of a rule is a capability the model does not have.

If the agent must never publish, do not tell it not to publish — give it a tool that only creates drafts. If it must never quote a price, do not give it the pricing data. If it must never write to production, scope its credentials to read.

The difference matters under pressure. An instruction has to hold across every prompt injection, every jailbreak attempt and every strange edge case. A missing tool holds by construction.

What is left for the prompt

Plenty — tone, structure, what to ask next, when to hand over to a human. Those are judgement calls where guidance is the right instrument.

Keep the prompt for judgement and the architecture for guarantees. When you find yourself writing "never" in a system prompt, that is usually a sign the constraint belongs one layer down.