the biggest takeaway for me is that prompts cant protect the final action if the model can speak the effect directly then thats where the real guardrail needs to live