Governing by Suggestion: Natural-Language Guardrails, Prompt Injection, and the Standard of Reasonable Care in Agentic AI Deployment

Abstract: Natural-language guardrails bind nothing. Deployers commonly express safety boundaries as prose instructions in a system prompt, even as they grant those agents technical access to production databases and payment gateways. Words cannot enforce technical boundaries. A model processes operator directives and injected adversary text through the same channel, resolving conflicts through shifting probabilistic weights. Vendor updates alter those weights without warning. Measured against established legal doctrines, the practice presents nonbinding guidance as an enforceable rule. Computer security has addressed complete mediation since the 1970s, and deterministic policy layers outside the model are now feasible. The cost in task completion is modest. Under negligence and product liability doctrines, relying on natural-language guardrails where architectural controls exist is a failure of reasonable care. It is a design defect. Keywords: Agentic AI, Prompt Injection, System Prompts, Natural-Language Guardrails, Complete Mediation, Least Privilege, Confused Deputy, Reasonable Care, Products Liability, Design Defect, Reasonable Alternative Design, Soft Law, Model Drift, Indirect Prompt Injection, Autonomous Agents, AI Security Architecture, Application Security, Learned Hand Formula, FTC Unfairness, Sandboxing