We told the model the rule. It broke the rule in about one draft in twelve.

It invented a meeting

The model was never told today's date. It started writing relative-time lines such as references to yesterday, and our guard later had to forbid inventing a date, a call, an invite or a meeting that is not in the input. The date is now passed in.

It upgraded a credential

Asked to rewrite a real credential, a basic ordering agreement, the model drifts toward a stronger phrase the company does not hold. We took the credential facts out of the writing prompt and wrote prohibitions instead, with a test that fails on the wrong wording. The test failed against the old prompt and passes now.

It broke its own banned-phrase list

We measured, because we had only assumed. In a handful of eval runs the model used a phrase it had been told never to use in roughly one draft in 12 to 20, and production had no check for it at all.

Now one generated phrase list feeds both the eval and a check on every draft, and a draft that breaks it shows a red badge naming the phrase on the approval screen. It flags; it never rewrites silently.

The defaults all said send

The database column default, the fallback in the normaliser, the save function and the setup screen all chose automatic sending. Every one now defaults to approval. When the model produced its working notes and no email, they used to be queued as the draft. That is now a failed generation. In one version, 6 of the 22 eval cases produced notes and no email.

What to take from it

• Put a deterministic check on the send path. The prompt asks; the check enforces.
• Measure the model. We assumed obedience until we counted.
• Keep a human last. Every default should fail closed to approval.