Rules that must always hold belong in code, not in the prompt

A model follows instructions very well, but not always. If a rule fails in 2% of cases, that may be fine for a writing style. For a legal, security or business rule, it is not.

The question to ask

Read the requirement and look for the words “always”, “never” or “no exceptions”. If they appear, the rule has to be guaranteed by code (programmatic enforcement). Prompt-based guidance steers the model, but it doesn’t bind it.

Where the guarantee goes

• Prerequisite gate: code blocks a tool until the previous step has completed. For example, process_refund doesn’t run until get_customer has returned a verified customer ID. Verifying identity before moving money is not left to the prompt.
• Intercept the call with a hook: in the Agent SDK, a hook checks every tool call before it runs and blocks the one that violates policy, for example a refund over $500, and redirects the case to another workflow, such as escalating to a human. A PostToolUse hook works on the other side: it transforms the result before the model reads it, for example to normalize dates that arrive in different formats.
• Validate before executing: the tool handler checks the parameters and rejects whatever doesn’t comply. For example, book_meeting rejects a time outside 09:00–18:00. The rejection goes back to the agent as a result, so it can propose another time.
• Add after the model: mandatory text (a legal disclaimer) is appended by code before sending.
• Remove before the model: if sensitive data never reaches Claude, Claude can’t output it. Preventing beats filtering.
• Read from the source of truth: if the report must always list the gaps, code takes them from the coverage map and appends them as a fixed section.

The usual traps

All of these are still probabilistic, so they guarantee nothing:

• repeating the rule, moving it to the top or writing it in capitals;
• adding few-shot examples;
• lowering the temperature to 0;
• adding a second model to check or rewrite.

In the exam

If the scenario says the rule “fails in 1 of every 200 cases” and asks for “the strongest guarantee”, rule out everything that is an instruction to the model and look for the option that solves it in code: a hook, a prerequisite gate or the tool handler.