If a hacker sneaks instructions into an AI agent's inputs, what kind of rule can't be talked around, and is easy to test?

This explores what lets a rule on an AI agent hold up when attacker-written text is in its context, and stay simple enough to check like a unit test while the system runs. The corpus has no note that tests prompt injection head-on, so what follows is assembled from neighbouring work on guardrails, verifiers and audit design. The notes converge on one answer. A constraint is injection-proof when it sits outside anything the model can be talked out of. It is unit-testable when it is stated over something the system records, not something the model decides.

Start with where the rule lives. One note describes an explicit-boundary regime that bundles clear authorization rules with restricted tools and reports zero protected-test modifications. But Do authorization rules or restricted tools prevent test modifications? points out that no single-factor ablation shows whether the agent could not cross the line or simply did not choose to. The same pipeline reports a 100% Judgment Bypass Rate alongside a 0% Unsafe Action Rate. My reading is that a rule the model follows and a rule the model cannot break are different things, and only the second survives an injection. It also gives a testing recipe: remove the tool restriction alone, then the written rule alone, and see which one was doing the work. Generation is a poor place to put enforcement anyway. Why does autoregressive generation fail at constraint satisfaction? argues that autoregressive models cannot retract emitted tokens, which constraint solving depends on, and symbolic solvers help because they supply that missing piece. Can reasoning models actually sustain long-chain reflection? adds that frontier reasoning models reach only 20-23% on constraint satisfaction problems that demand real backtracking. A different bet is Can governance rules embedded in runtime memory actually protect autonomous agents?, where safeguards live in the memory layer the agent consults, and 889 governance events were logged over 96 days. That works because the agent actually reads the rules and the events are countable. Nothing in the note claims the rules would withstand hostile text, and a rule the agent reads is a rule the agent can be argued out of.

Testability comes from stating the rule over a finite record of events. Can a finite lifecycle model detect reward hacking across benchmarks? models a run as a typed event lifecycle checked against the task's bindings. The same formal object serves static pre-run analysis and runtime instrumentation, so the check you run in a test is the check you run live. It also replaces pattern-matching on suspicious content with deviation from an intended structure, which matters for injection because you don't have to recognise the attack, only notice the run left its lifecycle. That structure has to carry memory. Can stateless checks ever catch sequence-level constraint violations? shows that per-action checks cannot express rules that depend on history, so individually permitted actions can add up to a violation. A testable constraint is closer to a small state machine over the trace than a filter on one call.

To run such a check live without slowing the agent, Can verifiers monitor reasoning without slowing generation down? lets a verifier run alongside a single reasoning trace. It forks to extract verifiable state and intervenes only on a violation, with near-zero latency cost on correct runs. Because the verifier is a separate process, an injected instruction in the agent's context has no direct path to it.

The last question is how much of the check can be exact. Can scoped agents reliably judge semantic hacks in runtime analysis? draws the line explicitly. Infrastructure records are the unchallengeable step, and an LLM auditor's judgment is the arguable step after them. That auditor is scoped by a limited remit, fixed artifacts and required evidence citations, though its reliability is still unquantified. Can validator consensus guarantee both agreement and semantic correctness? finds the same split in validator consensus. Agreement holds deterministically, but semantic validity holds only statistically. The exactly unit-testable part of a constraint is the part that needs no model to judge it. To keep the record itself from being rewritten after an attack, Can commitments protect sensitive agent data while enabling verification? anchors commitments rather than content, so the record is tamper-evident without being exposed. The cost is that organizations must keep the underlying content, which raises deletion and access-control questions.

The notes suggest three questions to ask of any constraint. Can the agent physically reach the forbidden action? Is the rule stated over recorded events, including history? Is the check exact, or does it rely on a model's judgment? Each 'no' moves you from a guarantee toward a statistical estimate. The main gap is that nobody in this set has run the clean ablation that separates an action the agent can't take from one it merely didn't take.