# Decision Points in AI Agent Development # Prompt Control vs Code/Policy Control 🛡️ 🎯 The Hook When constraining agent behavior, you either "ask nicely" via prompt or "build a wall" in code. This distinction maps directly to probabilistic compliance versus deterministic enforcement. Writing "do not output personal information" in a prompt can be overridden by prompt injection or diluted by context expansion. A regex that detects and blocks PII patterns works reliably regardless of what the LLM decides. The real question is: which constraints do you elevate to code? 📋 Overview Prompt control writes constraints into the LLM's system prompt or instructions to guide behavior. Typical techniques include few-shot examples, negative instructions, and role setting. Code/policy control implements constraints as executable code (conditionals, regex, schema validation) or via policy engines (OPA/Rego, Cedar, etc.), forcibly controlling LLM inputs, outputs, and operations. 🔍 Decision Points Two variables drive this decision: **failure cost** and **accountability**. 📊 **By constraint type**: Enforce with code/policy: - 🔒 Boundary and legal constraints (PII output prohibition, amount limits, forbidden operations) - 🔒 Irreversible operation restrictions (deletion, transfers, publication) - 🔒 Output format enforcement (JSON schema, value range validation) Guide with prompts: - 💬 Response quality and style (tone, politeness, technical terminology usage) - 💬 Context-dependent judgment guidelines (what to prioritize under which circumstances) 💡 Key Details 🟢 **Prompt control excels in flexibility and expressiveness.** Written in natural language, it can instruct subtle nuances and context-dependent behavior. "Use formal language for legal teams, allow technical jargon for engineers" is naturally expressed in a prompt. Changes require only rewriting the prompt -- no deployment. The weakness is low reliability: constraints can break under prompt injection, context expansion, and model updates. Version control, testing, and auditing are also difficult. 🟡 **Code/policy control excels in certainty and auditability.** Constraints are version-controlled as code, verified by unit tests, and preserved as audit trails. "Why was this output blocked?" is uniquely identified by the policy version and rule ID. It is immune to prompt injection and model updates. With policy engines, rule changes can be reflected without deployment. The weakness is limited expressiveness -- qualitative constraints like "respond politely" cannot be expressed in code. ⚖️ Trade-offs | Dimension | Prompt Control | Code/Policy Control | |---|---|---| | Reliability | Probabilistic (can break) 🔴 | Deterministic 🟢 | | Expressiveness | High (nuance capable) 🟢 | Low (condition → judgment only) | | Auditability | Requires prompt history tracking | Version control + audit trails 🟢 | | Injection resistance | Vulnerable | Immune | | Change velocity | Prompt rewrite only | Policy update or deployment | | Development cost | Low | Infrastructure + skills needed | 🛠️ Use Cases 🔵 **Prompt control fits**: Response tone and style guidance, context-dependent judgment guidelines, cases where constraint violation impact is minor. 🔴 **Code/policy control fits**: PII and financial data output control, irreversible operation restrictions, regulated processes, strict output format validation. 📌 **Default strategy**: "Boundaries (constraints that must not break) go in code; guidance (desirable behavior) goes in prompts." When in doubt, ask yourself: "How much does it hurt if this constraint is violated?" If the pain is significant, enforce it in code. If minor, guide it via prompt. The most practical architecture is a two-layer structure: policy enforcement plus prompt guidance. Code/policy deterministically enforces boundaries while prompts guide LLM behavior within those boundaries. Even when prompt guidance fails, policy acts as the final safety net. #AIAgents# #SoftwareArchitecture#