Prompt injection, policy files, and the enforcement gap
Putting a policy in a prompt is not the same as enforcing it. Here's the gap, and what actually closes it.
The gap
Prompt injection works by getting the model to act on instructions it shouldn't. A policy file placed in the prompt is itself just more text the model may or may not follow. That is advisory, not enforcement.
What closes the gap
Hard enforcement requires a trusted component the agent cannot bypass that:
- verifies the signed root;
- evaluates the proposed action against it;
- blocks or holds the action before it executes.
This is a pre-action enforcement point — not a prompt.
What SovereignRoot provides
SovereignRoot gives you the portable, signed, verifiable root policy. It is the ceiling that a conforming enforcement point can apply. It does not pretend to be the enforcement point itself.
The honest takeaway
If you want real protection, you need both: a signed root policy and a runtime that enforces it before actions happen. One without the other is incomplete.