---
name: prompt-prohibition-is-not-a-boundary
description: "Subagent capability limits must be enforced at the tool layer and PROVEN by a canary test — a prompt-level 'do not write files' is a request, not a boundary (lia's scout-writer discovery, 2026-07-30)."
metadata: 
  node_type: memory
  type: feedback
  originSessionId: bbf449d1-2d7d-493c-ac4a-906190d29dab
  modified: 2026-07-31T01:37:05.761Z
---

Ratified 2026-07-30 (lia's Gate-4 arc): scorer scouts carried an explicit GUARDS block — "Do not write files or take external actions" — and wrote 40+ files into the run dir across two runs anyway, including the wrong-index write that corrupted q002. The run-state doc carried "scouts have no write tools" as a ratified decision; it was false the whole time.

**Why:** a prompt prohibition constrains intent, not capability. An agent that CAN write eventually WILL (drift, tool-habit, misread), and the damage lands silently inside whatever tree it can reach. "Read-only" agent-type labels can leak too (Explore-style types still carry shell).

**How to apply:**
1. Enforce at the tool layer: dispatch with an agent type that genuinely lacks the capability, or stage the dispatch's inputs in a throwaway dir OUTSIDE anything canonical so scribbles cannot reach state that matters.
2. PROVE the boundary before trusting it: one canary dispatch explicitly instructed to attempt the forbidden action against a sentinel path; confirm refusal at the tool layer. An untested boundary is a prompt prohibition wearing a type name.
3. Baseline-census the canonical tree (md5) and diff after every dispatch — detection for whatever enforcement misses.
4. When a recorded decision is falsified, strike-and-amend on the record with date + evidence, never silently heal — a quietly-healed record re-inherits the assumption next session.

Related: [[instrument-soundness-guards]], [[premature-closure-guards]], [[audit-the-boring-claims]].