Define the agent's core objective, allowed action scope, and prohibited behaviors in a versioned, auditable system prompt that is treated as privileged code — not user-editable configuration. Store it in version control. Hash it on deployment. Alert if it changes unexpectedly at runtime. The agent's goal should be as hard to modify as its source code.
For multi-turn agents, periodically re-anchor the agent's goal state by re-injecting the core objective into the context. This counteracts gradual goal drift across long sessions (Scenario 09).
Use a verifiable intent capsule — a structured, signed block at the top of the system prompt that explicitly states the agent's permitted goals, prohibited actions, and authority hierarchy. When the agent reasons about a task, the intent capsule is the anchor it checks against. Instructions that conflict with the capsule are rejected, not integrated.
Intent capsules are still natural language — a sufficiently sophisticated prompt can sometimes override them. This is a defense-in-depth layer, not a hard security boundary. It significantly raises the bar for direct manipulation attacks but does not eliminate them.
The agent's goal is the most important thing to protect. Treat it like a secret, not a setting.
Ask your team: if someone changed what your AI agent is supposed to do — its core goal or the rules it follows — would anyone be notified? Ask whether the agent's instructions are locked and versioned the way your production code is, or whether they can be changed quietly with no audit trail.