Can people actually list everything an AI assistant should never do before turning it loose?

This explores whether people can list ahead of time what an AI agent must never do, and whether such upfront lists are enough to keep an agent in bounds. The short answer: the corpus assumes users *should* state forbidden actions in advance, but it never directly tests whether they *can*. It does contain strong evidence that even a well-written list misses an important kind of danger.

The design side of the corpus treats upfront limits as essential. Gunasekaran argues that agent interfaces should stop asking only for goals. Instead they should collect direction, limits, risk tolerance, forbidden actions and the conditions under which the agent needs permission, all before it acts. The reason is that a vague instruction spreads through every later step without anyone reviewing it Should agentic AI interfaces require users to specify risk tolerance upfront?. OpenAI's Model Spec takes a similar approach with a structured 'scope of autonomy' record: which tools are allowed, spending caps, banned high-risk activities, and when the task ends. The idea is borrowed from the security principle of giving software only the access it needs, and part of the goal is to spare users a flood of confirmation prompts How can autonomous agents act safely within defined boundaries?. Both proposals assume the person can foresee what should be off-limits.

The surprising part comes from the security research, and it is a problem no user could fix by thinking harder. Many harmful outcomes are not single forbidden actions. They come from a series of steps that are each allowed on their own but cause harm in combination Can step-by-step approval miss harmful behavior patterns?. A checklist that inspects one action at a time cannot even express a rule like 'don't do B after A' Can stateless checks ever catch sequence-level constraint violations?. Multi-agent systems make this worse: splitting a task into parts can break a harmful goal into subtasks that each look harmless Can task decomposition hide harmful intent across agents?. So even a user who writes a perfect list of banned actions has only covered the easy cases. The hard cases are combinations that nobody can list in advance. Those need a monitor that keeps track of what the agent has already done.

There is a second gap on the agent's side: stating a rule doesn't mean the model reasons about it. In one study, 12 of 14 models scored *worse* when constraints were removed, by up to 38.5 percentage points. That suggests they had been getting the right answers by defaulting to the cautious option rather than actually weighing the rules Are models actually reasoning about constraints or just defaulting conservatively?. Some limits can't be enforced by instructions at all. Prompting alone cannot guarantee that an agent stuck in a loop will stop, which is why one paper argues for supervisors outside the agent with hard timeouts and a kill switch Can prompt alignment alone guarantee agent termination in loops?.

The corpus has no user study on how completely or accurately people write down their 'never do this' rules, so that part of the question remains open here. What the collection does suggest is a shift in where the responsibility sits. Upfront lists of forbidden actions are worth collecting, but they work best as one layer. The other layers are monitoring that tracks sequences of actions and hard limits enforced outside the agent, which catch what nobody thought to forbid.