Deterministic guardrails vs. probabilistic LLM evaluators

An evaluator written as a prompt is useful for judging whether an answer reads well. It is the wrong tool for deciding whether an agent may write to a repository, because its answer is a sample rather than a decision, and samples vary.

So the bounds are not prompts. A station's tool loop stops after a fixed number of steps. An observation is truncated to a fixed length before it re-enters context. A tool call either matches a policy grant or it does not. None of those outcomes depends on how a model felt about the request.

Inside the bounds. Planning, drafting and evaluation are exactly the work a model should do, and the loop gives them room — it just does not let them decide where the edge of the sandbox is.