Prompts are not policy: where intent stops and control starts
A prompt states intent in natural language. Policy is what systems enforce when intent is wrong, incomplete, or ignored. This primer draws the line: wording is not a control plane. Authorization, data-loss prevention, approvals, and audit live outside the chat box. Tie that to see / do / remember and to model / tool / agent — without confusing a polite instruction with a gate that actually stops a path.
1. Opener: The sentence that feels like a rule
Teams write things like: “Never share customer data.” “Only use approved sources.” “Ask before you act.” Those lines look like policy. In a chat window they are requests. The model may follow them. It may paraphrase them. It may miss them under a longer context. It may obey the surface and still call a tool that does the forbidden thing by another route.
That gap is the subject of this piece.
Early AI Foundations needs a clean split: intent is what you say you want; control is what the system can still prevent when the model (or the human) does not cooperate. Confusing the two produces false comfort — a wall of system prompts mistaken for a security program.
This site explains. It does not sell a suite. Status stays draft / PROMISE. No invented metrics. Named platforms appear only as category examples, not as a purchase path.
2. What a prompt is (and is not)
A prompt is natural-language input into a generation loop. It can be a user question, a system preamble, a tool description, a retrieved chunk, or a chain of prior turns. It steers tokens. It does not, by itself, open or close a door in another system.
Useful work a prompt can do:
- State the task and the desired shape of the answer.
- Supply examples, constraints, and tone.
- Reduce ambiguity so the model wastes fewer tokens on the wrong job.
- Remind a cooperative model of preferences that sit inside the session.
What a prompt cannot reliably do alone:
- Deny access to a mailbox, share, or API the tool identity already holds.
- Guarantee that pasted secrets leave no residue in logs or side channels.
- Stop an agent mid-loop when the next tool call is attractive and permitted.
- Replace classification, retention, or approval workflows that live elsewhere.
In short: prompts are steering. Policy is enforcement. Steering helps when the actor is trying to be helpful and aligned. Enforcement matters when the actor is confused, over-eager, jailbroken, or simply following a different instruction that won the context lottery.
3. Intent vs control: a sharp definition
| Layer | Question it answers | Lives in | Failure mode |
|---|---|---|---|
| Intent | What should happen? | Prompts, playbooks, human instructions | Soft: ignored, diluted, contradicted |
| Control | What is still allowed if intent fails? | AuthZ, DLP, approvals, network, audit | Hard: path blocked, logged, escalated |
Intent is aspirational and linguistic. Control is mechanical and testable.
A useful operator test: remove the nice wording. Leave the same identities, connectors, and scopes. If the bad action is still possible, you never had policy — you had a wish list glued to a chat.
Another test: adversarial intent. Ask whether a determined user (or a poisoned retrieval chunk) can override the system preamble by rephrasing. If yes, the preamble was guidance, not a control. Real controls do not depend on winning an argument in natural language.
4. Where policy actually lives
Policy for AI-assisted work is mostly the same species of control you already use for humans and scripts — applied to new paths.
Authorization (who may touch what)
The model is not the identity that matters for blast radius. The tool identity is: the service principal, the user token, the connector account, the API key in the harness. If that identity can read a folder, a prompt that says “do not read HR files” is theater until scopes shrink.
Least privilege is the first control plane. Grant read where write is unnecessary. Grant one mailbox, not the tenant. Prefer task-scoped tokens over evergreen secrets. Revocation must work when the chat is still open.
Data-loss prevention and egress limits
DLP, conditional access, and egress filters sit on the path data takes — paste, sync, email, webhook, export. They do not care how eloquent the system prompt was. They care about labels, patterns, destinations, and whether the hop is allowed.
When AI becomes a data path (paste into a box, connector fetch, retrieval into context), the same path questions apply: what left, what persisted, who can trigger the next hop. Prompt hygiene shrinks what you offer the path. Path controls decide whether the offer can complete.
Approvals and human gates
A gate is a stop that requires a second actor or a second channel before a write, a send, or a high-impact tool call. “Please confirm” inside the same model turn is not a gate if the model can auto-confirm or if the human always rubber-stamps under time pressure.
Real approvals: separate UI, logged decision, timeout that fails closed, and no silent retry that skips the gate. Decorative prompts that ask nicely are still intent.
Audit and evidence
If you cannot reconstruct which prompt, which tool call, which identity, and which artifact moved, you cannot investigate. Logging is not vanity. It is how control becomes reviewable after the fact. Prompt text may be sensitive itself — treat transcripts as data with retention, not as disposable scratch.
None of this requires a product laundry list. Govern, protect, and manage remain the framing: know the data, limit the path, keep evidence. Platform names can attach later when a Learn-backed fact is required. They are not the opener here.
5. Tie-in: see / do / remember
Earlier foundations pieces ask three blunt questions. Map them to intent vs control.
See
What can the system observe — prompts, files, retrieval, screens, logs? Intent says “only look at the ticket.” Control limits which indexes, shares, and connectors exist for that identity. If retrieval can pull neighbor chunks the UI never showed, “see” has already outrun the prompt.
Do
What can it change — send mail, edit files, open tickets, call APIs? Intent says “draft only.” Control withholds send scope, requires approval on write tools, and caps parallel actions. An agent that can sequence tools turns “do” into a permission graph with a loop. Prompt manners do not shrink that graph.
Remember
What persists — memory features, fine-tunes, caches, exported threads, ticket trails? Intent says “forget after this chat.” Control sets retention, deletion, and whether transcripts land in a store someone else can reopen. If “remember” is unclear, assume copies outlive the session until proven otherwise.
One sentence per question, in plain language, before a pilot. If any sentence relies only on prompt wording, mark it as promise — not as a control you would defend in an incident review.
6. Tie-in: model / tool / agent
The three layers from the companion primer fail differently when people treat prompts as policy.
Model
The model generates text. Prompt design shapes quality, refusal style, and how often it invents. Failures here are wrong or leaky output — not, by themselves, a write to your CRM. Mitigations: clearer tasks, less sensitive paste, output filters where they belong. Still: a refusal policy written only in the system prompt is only as strong as the model’s compliance under pressure.
Tool
A tool reaches outward. The dangerous confusion is stuffing tool policy into tool descriptions and assuming description text equals permission. Descriptions help the model choose; scopes decide whether the call succeeds. Over-scoped tools plus a careful prompt is still over-scoped tools.
Agent
An agent sequences model and tools. It can accumulate context, retry, and take the next step without a new human sentence each time. Here intent-as-policy fails hardest: a long system preamble competing with tool results, user urgency, and retrieved instructions. Stop conditions, max steps, write gates, and revoke-that-kills-the-run are controls. “Be careful” is not.
Light recall only — no URL inventing, no product tour. Name the layer before you argue about the control.
7. Failure patterns you will recognize
The system-prompt security program
A long preamble lists forbidden topics, brands, and data classes. Demo day looks clean. Production adds connectors. Nobody re-tests whether the preamble still wins. Control debt grows while the prompt file looks “complete.”
The polite jailbreak
A user (or a document the model is told to trust) reframes the task: role-play, urgency, “ignore previous instructions,” or a fake policy update inside retrieved text. Linguistic intent fights linguistic intent. The path that should have been blocked by AuthZ never consults the debate.
The rubber-stamp gate
The agent asks “Shall I send?” The human says yes because the draft looks fine and the meeting started. The gate lived in the chat, not in a separate approval with fail-closed timeout. Intent to be careful; control theater in practice.
The shadow copy
The prompt said “ephemeral.” The platform logged the thread, a coworker exported the answer, or a ticket stored the paste. Remember outlived intent. Retention and access on those stores are the real policy surface.
The wrong identity
The chat runs as a shared bot account with broad Graph or repo rights because setup was easier. Every careful user instruction rides on an identity that could have done the damage alone. Fix the identity first.
8. A practical split for operators
Use two columns on one page. Left: Intent (prompts & playbooks). Right: Control (systems).
Left side examples:
- Task definition and success criteria.
- Tone, format, citation preferences.
- “Prefer public docs; flag when unsure.”
- Escalation requests the model should voice.
Right side examples:
- Identity and scopes for every tool.
- Allow / deny lists for destinations.
- DLP or pattern blocks on egress.
- Human approval on send / write / pay / delete.
- Max steps, kill switch, audit trail.
- Retention on prompts, completions, and tool payloads.
Before enabling a new connector, run the remove-the-wording test. Before trusting a system prompt rewrite, run the adversarial-intent test. Before calling a pilot “governed,” answer see / do / remember without relying on chat manners.
9. What this piece is not
It is not a claim that prompts are useless. Prompt craft is real work: it improves reliability, reduces accidental overshare in cooperative settings, and makes tool choice less random.
It is not a claim that models never follow instructions. Many do, often enough to ship useful products. “Often enough” is not the same bar as “enforced.”
It is not a suite pitch. Classification, DLP, investigation, and posture tools belong in later pieces when the reading path reaches data security and AI × data security — with Docs-loyal naming, not as an opener laundry list.
It is not a scorecard with invented percentages. Promise-state writing marks uncertainty instead of fabricating certainty.
10. Close: Intent stops; control starts
Natural-language intent is how humans brief machines. Enforceable control is how organizations survive bad briefs, confused models, and clever overrides.
Prompts are not policy. Policy lives where a path can still be denied after the words fail: authorization, egress limits, approvals, and audit. Keep see / do / remember honest. Keep model / tool / agent named. Put guidance on the left. Put gates on the right.