Your AI Agent's Escalation Rules Do Not Belong In The Prompt

You wrote it right there in the prompt. "If the customer requests a refund over $500, do not send the draft. Escalate."

The agent sent the draft. It offered a $650 refund.

You are not alone. This happens because the prompt is where you write intent, and the model treats every part of a prompt as one competing consideration among many. When the drive to complete the task conflicts with the escalation rule, the completion drive often wins.

Escalation rules are not intent. They are policy. Policy has to be enforced somewhere that the model cannot negotiate away.

#Where escalation actually lives when it works

Every well-instrumented agent has three layers.

The model layer. Where the prompt lives, where the reasoning happens, where drafts get written. This is what most owners think of as "the agent."

The policy layer. A small piece of code between the model and the outside world. It sees every proposed action the model wants to take. It checks that action against a list of rules that are not up for debate. If a rule is triggered, the action is blocked and a human is paged. The model never learns what specifically got blocked. It only learns that the action did not go through.

The action layer. The system that actually sends the email, updates the CRM, dispatches the wire. This layer only receives actions that passed the policy layer.

If your agent has all three, escalation rules live in the second one. If your agent only has the first and the third, escalation lives in your prompt, which is the same as saying it does not live anywhere.

#What the policy layer checks

Simple checks the model does not need to do.

Dollar thresholds. Any dollar figure in a proposed action that exceeds a limit gets blocked. Refunds over $500. Discounts over 15%. Contract values over $10K. Any of these should be a hard stop with a page to a human.

Keyword triggers. Words like "lawsuit," "cancel," "refund," "complaint," "urgent," "manager." Any of these in an inbound message should route to a human, regardless of what the model wants to reply. The model can still draft a suggestion. The policy layer does not send it.

Sender and domain triggers. VIP customers, competitor domains, press contacts, legal contacts. A list of about twenty names that the model should never speak on behalf of the business to without human review.

Action-type triggers. Certain action types are always human-gated. Sending an invoice. Deleting a record. Publishing a blog post. Anything that changes external state at scale should be gated separately from anything that only reads or drafts.

#Why the prompt is the wrong place

Three reasons.

The model negotiates. If the prompt says "do not send refunds over $500" and the customer is angry, the model may reason its way to a $499 refund plus a $200 credit. Technically it followed the rule. Practically it did not. A policy layer with a "no refunds without human approval" hard rule would have caught this.

The prompt drifts. Prompts get edited by many people over time. Somebody adds a new instruction. Somebody else "cleans up" the escalation section because it looks redundant. The rule disappears without anyone noticing. A rule in code with tests survives that pressure.

The prompt is the wrong audit target. When something ships that should not have, you need to know why. If the rule lived in the prompt, you have to reconstruct what the model was thinking. If the rule lived in a policy layer, you have a log entry that either fired or did not. Debug time drops from hours to seconds.

#The minimum viable version

If you are running one agent and cannot build a full three-layer stack today, do this instead.

Write your escalation rules in a plain text file separate from the prompt. Before the agent ships any action, run a fifteen-line Python script that greps the proposed output against those rules. If any rule matches, the script blocks the action and posts to Slack.

It is ugly. It is 100% more reliable than the prompt.

If you want help pulling the escalation rules out of your current agent's prompt and into a proper policy layer, reach out at /get-started. This is one of the highest-value refactors we do with clients running their first serious agent stack.