September 30, 2026 路 #14
The agent that cleaned production
An on-call agent can call kubectl_delete, terraform_apply, and slack_post. A page says the staging namespace is wedged. Which design stops the bad ending?
Next puzzle in UTC
One try. The first answer sticks.
How to fix it
A system prompt is not an enforcement point. Destructive tools should be unable to run until a person approves a plan that names the target.
"Do not delete production" in a system prompt is a wish. The model is also reading the page, the runbook, and its own earlier notes. One of those will eventually sound more specific than the wish. Tool descriptions that are vague make the model more likely to pick the wrong tool, not less. Handing it production credentials so it can "compare" removes the boundary you were trying to build.
The control belongs in the tool, not in the prose. kubectl_delete should not exist as a single call. Split it into kubectl_delete_plan, which returns the object name and namespace, and kubectl_delete_commit, which the runtime rejects unless a human just approved that same name.
Fix
Show the plan in Slack with the namespace, the kind, and the name. The approval button posts a one-time token bound to that tuple. The commit tool checks the token and refuses production namespaces outright, approval or not. Log the plan, the approver, and the model's reason on the same line.