Scope the tool, not the prompt. Permissions come from keys, not instructions
"Do not deploy" in a prompt is a request. A token that cannot deploy is a rule. Any safety that lives in instruction text can be overridden by a later instruction, a poisoned rules file, or the model deciding the instruction did not apply this time.
Where it bit
A bare wrangler deploy from the worker folder redeployed the whole site, because wrangler walks up the tree and found the site's config first. Fixed by pinning -c wrangler.toml in the npm script, so the wrong command is no longer possible to type. The cron in 09 is the same lesson. Our operating rule is written as "keys, not prompts" for this reason.
The practice
Tool allowlists per agent role. Scoped, expiring tokens per agent. Deploy commands that fail without an explicit config path. Rules files and .mcp.json diffs reviewed as code, with a grep for zero-width characters, because poisoned rules are now a documented attack on four coding agents.
Check it
grep -rnP "[\x{200B}-\x{200F}\x{2060}\x{FEFF}]" .cursor/ .claude/ CLAUDE.md .mcp.json 2>/dev/null
cat .claude/settings.json | grep -A20 '"allow"'Get this check as a script you can run tonight
What to do with this
If you run a business on something AI built and the checks came back with more than you expected, that is worth a conversation.
We do a free 30-minute Health Check for service businesses that want to know exactly where their biggest leaks are. No slide deck. No pitch. We ask questions, find the gaps, and tell you what we see. If there is no obvious fix, we will tell you that too.
Blinkz finds what is broken in how a business runs, then fixes it. AI only where it earns its place.