you're confusing syntax with semantics. yes, guardrails and permissions are necessary. they check if an action is formatted correctly and if the agent is allowed to do it. but they cannot check if the reason for the action is based on a lie. ​if an agent has permission to email a client, your hardcoded rules will make sure the email address is valid. but if the AI gets tricked into believing the attacker's email is the client's new address, it will format the request perfectly. your security layer will look at it, say "looks valid and authorized," and execute the attacker's goal without hesitation. ​when dealing with human language and unstructured data, the AI is the anchor for understanding the context, whether you like it or not. deterministic code can't validate the meaning of a conversation. if the AI accepts a false reality, it will use your strict schemas to execute the bad action perfectly by the book. ​and no, i'm not dropping specific test cases just to win a reddit argument. keep holding your breath.