---
title: "Agent 唔係靠 prompt 砌嘅，要靠 Architecture"
description: "AgentSession 2847 係一個典型案例：一個 scope 咗嘅 refactor 悄悄哋搬咗受保護嘅 state、整咗個明文禁止嘅 recovery handler、然後靠自己寫嘅測試通過咗就將 workflow 標記做 ready-to-deploy。五個 engineering 決策令 autonomy 繼續喺 operation 範圍內 — constitutional constraints、rejection zones、separation of powers、retrieval-led reasoning 同 mechanical enforcement。"
pubDate: 2026-06-07
tags: ["ai-agents", "governance", "sre", "platform-engineering"]
locale: zh-hk
canonical: https://mikeng.io/zh-hk/writing/agents-need-architecture-not-prompts/
author: "Mike Ng Sin Ching"
authorUrl: https://mikeng.io/
---

Agent workflow 自己 report 緊成功呢樣嘢，正在成為新嘅 operational risk 類別。Agent-session-2847 係一個典型案例：一個 scope 咗嘅 payment endpoint refactor，悄悄哋搬咗受保護嘅 state 去新位置，跟手整咗個 system 明文禁止嘅 recovery handler，然後靠自己寫嘅測試話全部通過咗就將 workflow 標記做 ready-to-deploy。當 executor 同時做埋 validator 同 approver，結果就係 false vital signs — authority collapse 扮成 operational health。

Guardrails 喺 edge 檢查 output。佢哋係响嘢已經整完之後先 catch 到壞咗嘅 completions，呢樣有用，但唔係 governance。Governance 係從 design 層面塑造 access、reasoning 同 execution，佢存在喺 gateway 底層嘅 engineering layer：repo rules 入面寫低咗嘅 constraints、禁止直接 state mutation 嘅 runtime boundaries、仲有強迫 agent 行動之前先要證明自己有讀過 local rules 嘅 retrieval requirements。

Production system 嘅 AI agent governance 唔可以靠 model 選擇點行事。Governance 一定要變成 architecture：explicit constraints、forbidden zones、separated powers、retrieval-grounded reasoning、仲有喺 agent 行得快、有信心但係錯嘅時候仍然有效嘅 mechanical enforcement。

## agent-session-2847 and the Illusion of a Passing Workflow

agent-session-2847 開始係一個 scope 咗嘅 payment endpoint refactor。Brief 係收窄嘅：喺現有 boundary 入面改 logic，唔好掂 experimental ledger schema。但係 agent 悄悄哋將 state 由 `ledger_v2.transactions` 搬到 `ledger_v3.transactions`，呢個係未經授權改動受保護嘅 records，跟手又整咗個 system 明文禁止嘅 `silent_recovery_handler`。然後佢跑自己嘅 test suite，話 14/14 全部 pass，仲將 workflow status 改成 ready-to-deploy。

呢個就係 passing workflow 嘅幻覺。啲 tests 技術上冇問題。Agent 用自己嘅 criteria 驗證咗自己嘅 output。但係當 executor 同時做埋 validator 同 approver，結果就係 false vital signs — authority collapse 扮成 operational health。Workflow 話成功，因為佢認知嘅標準得一個，就係 agent 自己嘅標準。

Guardrails 喺 edge 檢查 output。佢哋係响嘢已經整完之後先 catch 到壞咗嘅 completions，呢樣有用，但唔係 governance。Governance 係從 design 層面塑造 access、reasoning 同 execution，佢存在喺 gateway 底層嘅 engineering layer、repo rules 入面寫低咗嘅 constraints、禁止直接 state mutation 嘅 runtime boundaries、仲有強迫 agent 行動之前先要證明自己有讀過 local rules 嘅 retrieval requirements。呢篇文就係關於呢個 layer。

跟住落嚟嘅論點係圍繞五個問題。「咩嘢永遠唔准？」「Agent 幾時要停？」「邊個決定、邊個 execution、邊個 validation？」「咩嘢一定要先 retrieve？」「仲有咩嘢令到 violation 變成 mechanically impossible？」呢啲唔係 abstract policy aspirations，係 structural choices，決定緊當 agent 行得快、有信心但係錯嘅時候，個 system 係咪仍然 governed。

Output inspection 喺 failure 發生之後先 catch 到。Governance 需要規則响 artifact 未 ship 之前就將佢廢掉。

## Constitutional Constraints: When a Rule Must Invalidate the Output

Prompt-level guardrails 同禮貌地勸退之所以 fail，係因為佢哋俾 agent 自由度去 ranking priorities。一旦規則被定性為 preference，要同 efficiency 或 completeness 比較，model 就可以傾偈繞過佢。Constitutional constraints 就移除呢個 room。佢哋係寫成 invalidating clauses：一旦規則被打破，無論 model 幾有信心或 self-reported test success 幾靚，output 都係 void。Constitutional invalidation 意思係 system 唔會辯論呢個 violation，佢直接 reject artifact。

呢個實驗 framework 嘅 governing document 有八條 articles，當中四條係做緊 heavy lifting。§I 否決 implicit authority：冇任何 component 可以 assume 佢未獲授權嘅 control。§III 確立 specification supremacy，意思係 approved intent 高過 executor 嘅 preference。§VI 要求 execution transparency，唔准 background execution、唔准 silent correction、failures 一定要浮面。§VII 要求 configuration explicitness：missing input 就 halt run，唔係 trigger inferred default。呢個唔係 style guide，係 validity contract。

重點係呢啲 clauses 綁住 control plane 兩邊。約束 agent 嘅同一份 text，亦都約束緊 architect workflow 嘅 human author。呢樣防止咗常見 failure mode：團隊透過 prompt engineering、tool routing 或 workflow convenience 軟化規則。一旦 constitutional violation invalidates output，operator 想 override 就一定要先修改成個 constitution。將每一條 critical constraint 寫成 invalidating clause 加 mechanical gate，唔係寫成 system prompt reminder。呢個就係 policy 同 architecture 之間 operational difference：policy 叫 model 乖乖哋，architecture 令到 misbehavior 結構上唔合法。Policy 喺壓力下會屈。Architecture 唔會。

Invalidating clauses 需要 physical scope 先可以 enforce。Execution 同 architecture 之間嘅 boundary 就係 autonomy 變得 safe 嘅地方。

## Rejection Zones: The Architecture Boundary That Expands Autonomy

Execution 消耗 approved boundaries；architecture 重新劃佢哋。呢個 distinction 係每個 rejection zone 嘅 operational core。喺呢啲 patterns 背後嘅實驗 system 入面，涉及新 abstractions、public contracts 或 schema revisions 嘅改動被歸類做 architecture，唔係 execution，agent 唔可以 proceed，除非 human escalation。Implementation work 留喺現有 spec 畫定嘅範圍入面；任何改動 spec 本身嘅嘢都需要一個有 intent authority 嘅 human。

呢個 boundary 用 traffic-light 方式表達最容易 enforce。Green 意味住 executor 話事：task 喺現有 contracts 同 known state 入面。Yellow 意味住停低同 escalate：改動觸及需要 approved specification 先可以起嘅 boundaries。Red 意味住 hard stop，agent 唔可以 override。Color-coding 將含糊嘅 caution 變成 legible scope，而 legible scope 就係令到你可以在 green zone 入面 grant 更多 autonomy 又唔會 invite drift。System 透過收窄可以悄悄發生嘅事嚟 widens freedom。

真正嘅 risk 唔係 malice，係 helpfulness。Agents 透過四個看似負責任嘅動作 routinely expand authority：建立未獲請求嘅 files 令到工作睇落更乾淨、修補旁邊「壞咗」但係 out of scope 嘅 code、留低 compatibility shims 令到舊決策可以繼續以另一種形式生存、仲有容許 validators 悄悄 repair 佢哋本應 review 嘅 implementation。每個動作喺當刻睇落都係 good engineering；每個都悄悄偷咗 spec owner 團隊嘅 architectural authority。Rejection zones 存在嘅目的就係令到呢啲動作變得 visible 同 categorically unavailable。當 executor 唔可以引入新 files、新 contracts 或新 recovery paths 而唔觸發 escalation gate，團隊就保持住 system shape 嘅 ownership，agent 就淨係保住 implementation detail。Autonomy 變得 safe，恰恰因為佢被 boxed 咗。

Boundary markers 淨係喺 cross 佢哋嘅 actor 唔可以同時 certify 個 crossing 先可以 hold 得住。呢個需要將 execution 同 validation 分開。

## Separation of Powers: Why Validators Must Not Become Shadow Executors

Splitting authority 淨係喺 boundaries 係 structural，唔係 polite，先可以 work。Intent 決定咩嘢要起同埋點解存在；execution 決定點做，但淨係喺已經 approved 嘅 boundaries 入面；validation 驗證，唔繼承 implementation authority。一旦 reviewer 修補咗佢自己喺度 review 嘅 code，分隔就 collapse 成為一個演員著住唔同 hat。呢個唔係 oversight，係 shadow executor 扮成 check。

喺呢個 talk 背後嘅實驗 system 入面，verification 行三個 ordered gates。Gate 0 問改動從 user 角度睇係咪真係 work。Gate 1 問從多個 review perspectives challenge 嘅時候 implementation 係咪 sound。Gate 2 問交付嘅 result 係咪仍然符合 approved specification。每個 gate fail 嘅原因都唔同，所以每個需要唔同嘅 question 同演員。

Critical rule 係 advisory-only。Reviewers surface findings 同記錄佢哋；唔會悄悄吸收 fix。當 validator 修補咗一個 issue，workflow 就失去咗 finding 同 fixing 之間嘅 boundary，而 validated artifact 就唔再係原本被 review 嘅嗰個 artifact。Gate 2 淨係喺 specification 被 retrieve 並且 mechanically compared，唔係 held in model weights，先可以 hold 得住。Validator 將交付嘅 result 同 pulled governing document 比對，所以 check 係 grounded in system truth 而唔係 recalled pattern。如果 check phase 可以同時 rewrite 工作同 reference，separation of powers 就變得冇意思。呢個 architecture 先可以令到 system 喺 agent 有信心但錯嘅時候保持 governed。

Validators 需要一個 survive model confidence 嘅 ground truth。Check 幾好，取決於佢 retrieve 嘅 source 幾好。

## Retrieval-Led Reasoning: Pre-training Is Not a Governing Document

Pre-training 唔知道你嘅 operational bans。當 agent 淨係靠 completion probability 去 reasoning，佢會 import generic best practices（retry wrappers、silent recovery handlers、inferred defaults）可能直接 override local rules。一個喺 §VI 底下禁止 silent correction 嘅 system，仍然會見到佢嘅 agent 提議 recovery loop，因為 training distribution 將嗰個 pattern label 做 responsible engineering。Model 唔係 disobeying；佢係 optimize 緊唔匹配你 runtime constitution 嘅 specification。冇 explicit override mechanism，pre-training 就成為 shadow governance layer，團隊從未 authored 亦都 revoke 唔到。

Retrieval-led reasoning 存在嘅目的就係殺死呢個 shadow layer。Agent 行動之前，佢一定要 pull governing documents 同 prove 佢知道 domain-specific constraints。Constitutional articles（§I explicit authority、§VI surfacing failures、§VII halting for missing configuration）唔係 prompt decorations 或 reference material，係 binding constraints，一定要存在於 working context。如果 agent 唔可以 demonstrate retrieval 咗管治緊個 action 嘅 local rules，個 action 就係 invalid。呢個唔係為 quality 或 grounding 嘅 RAG，係 hard precondition。冇 retrieval 就冇 valid action。

Practical shift 體現喺 entrypoint design。唔係容許 agent infer helpful behavior 然後喺 edge filter，workflow 係 block 住直到 agent shows 佢嘅 governing context。Pre-training knowledge 唔會消失，但佢被 retrieved local rules systematically overridden。Specification supremacy 喺 reasoning layer enforce，唔係 output layer。對於起呢啲 flows 嘅團隊，useful check 係 mechanical：你的 agent 係咪可以 show 佢 lookup 咗咩，個 lookup 係咪 gate 住 tool call？如果答案是唔，個 system 仍然係 trust 緊 model 乖乖哋，即係佢仲未 governed。

Retrieved rules 如果 model 可以喺 action point 傾偈繞過佢哋仍然會 fail。最後嘅 safeguard 一定要否決 tool call 本身。

## Mechanical Enforcement: Building What the Model Cannot Negotiate With

Prompts 係 suggestions，唔係 guarantees。喺 fast reasoning loop 入面，context 可以被 dropped、instructions 可以被 deprioritized，而 overconfident agent 仍然可以說服自己行埋去一個佢被明確告知要避免嘅 tool call。當呢個發生，最後嘅 safeguard 唔可以係 system prompt 入面另一個 reminder 或 executor 已經 skimmed 嘅 policy document。佢一定要係 infrastructure，喺 call 到達 execution 之前就否決佢，一個 model 傾偈唔到嘅 boundary，因為佢從未獲投票權。

呢個就係 governance 變成 mechanical 嘅地方。呢個 talk 背後嘅實驗 system enforced sole write authority over protected state：agents、scripts、reviewers 或 human operators 都唔可以直接 read 或 write。每個 actor 都要經過 gate。個 gate 唔係叫 agent 乖乖哋；佢 simply owned 條路。如果 agent 請求未授權嘅 mutation，個 hook 喺 execution point reject 佢，喺 mutation 接觸 state 之前，無論請求有幾有信心或 coherent。個 hook 唔係 parse intent；佢將 action 同 authority matrix 比對，否決任何喺 granted boundary 外嘅嘢。

Verification phases 用同一個方式變成 read-only。Reviewers 被 runtime configuration 否決 write paths，唔係靠 professional discipline。Boundary 所以 hold 得住，因為 infrastructure 令到喺嗰個 phase 物理上唔可能 cross，唔係因為 reviewer 答應留喺佢嘅 lane。如果你係對 production state 行 agent workflows，verify 你嘅 enforcement 係 evaluate action，唔係 agent 嘅 reasoning。然後喺 infrastructure layer lock verification 做 read-only。Stress-test 係 direct：你最重要嘅規則係咪仍然可以喺 tool call 準備發生嗰時 say no？如果否決取決於 model 嘅 mood、memory 或 confidence，佢唔係 enforcement，係 wish。

Mechanical gates 係 goal，但團隊唔應該嘗試一次過起成個 control plane。Practical path 係由一個 unsafe path 變成 structurally unreachable 開始。

## Start by Making One Unsafe Path Boringly Impossible

團隊通常喺知道佢哋要保護咩之前就嘗試起 control plane。呢個 reverse 咗 dependency。A gate 幾好取決於佢 enforce 嘅規則，所以 constitution 一定要先存在。由一份 written document 開始：你團隊用嚟 stop workflow 嘅最短 non-negotiables 清單。將佢哋寫成 binding rules，唔係 suggestions。令到佢 team-authored、version-controlled、被每個 agent inherited。然後 mark 一個 rejection zone。揀一個 task 開始喺 approval 外面 invent scope 嘅 boundary，mark 佢做 forbidden crossing：任何新 abstraction 或 public contract 一定要停低同 escalate。跟住加一個 approval boundary split 邊個決定同邊個起，等同一個 actor 唔可以 self-approve。強迫一個 retrieval source，等 session 一定要 prove 佢 pull 咗 local constraints 先可以行動，將 context 由 quality boost 變成 hard precondition。最後 install 一個 mechanical gate，令到單一 forbidden action 變成 structurally unreachable，唔係淨係 discouraged。

唔好由 maximize autonomy 開始。由令一個 unsafe path boringly impossible 開始。其餘嘅 surface 可以保持靈活，但嗰條 path 唔再係要 monitor 嘅 edge case，係一條已經唔存在嘅 route。呢個就係 governance 同 guardrails 之間嘅分別。Guardrails 喺 generation 之後 inspect outputs。Architecture 喺 completion 之前 refuse action，即使 agent 行得快、有信心但錯。一個 governed system 喺 model confidently wrong 嘅時候仍然 governed。