I had the same realization recently. The moment an agent gets access to real infrastructure, it stops being a prompting problem and starts being an infrastructure problem. We've been moving more and more of those decisions into runtime policies in Failproof AI instead of hoping the model remembers the rules.