Spot-on analysis, Playmodgame1111—I completely agree. System prompts are at best a "soft steering mechanism," not a security or compliance boundary. If an architecture relies solely on a system prompt saying "Never invent a rate," it will eventually fail in production. That’s why the article framing emphasizes that prompts are only one layer in a broader defense-in-depth model: Deterministic API & Schema Validation: Factual inputs (rates, ETAs, HS codes) must be retrieved through deterministic tools with strong typing and schema validation before reaching the LLM context. Policy Engines & Execution Gates: The prompt acts as local guidance, but the orchestrator (e.g., LangGraph state machine) enforces hard limits—forcing high-stakes financial commitments or capacity re-bookings behind Human-in-the-Loop (interrupt()) state checkpoints. Non-LLM Routing for Routine Telemetry: High-frequency, standard state transitions are moved out of the LLM entirely and handled via deterministic code paths to bound both execution risk and API costs. Prompts provide intent alignment, but enterprise safety strictly requires hard deterministic policy layers, API-level scope permissions, and transactional circuit breakers around the agent. Appreciate you highlighting this crucial distinction!