---
title: "Action checks vs. rules in the agent’s prompt · Audon"
description: "Why refund and discount limits in an AI agent’s prompt are not controls, and how deterministic checks outside the model, before the action runs, differ."
url: https://audon.ai/compare/prompt-guardrails
last_updated: 2026-11-02
---
# Action checks vs. rules in the agent’s prompt.

The quickest way to limit what an agent does is to tell it: “never refund more than the order total”. That instruction is read by the model, and a model can be talked out of it. Audon checks the action itself, outside the model, before it reaches Stripe, Shopify or your system.

[Start action auditFree](https://audon.ai/sign-up?intent=integrity) [All comparisons](https://audon.ai/compare)

## Side by side. Facts about Audon from the product and its docs.

| Aspect | Agent Action Control | Rules in the prompt |
| --- | --- | --- |
| Where the rule runs | Outside the model, in deterministic code, on every action the agent proposes. | Inside the model’s instructions. |
| Fresh facts | Business rules read the provider first: captured amount, already refunded, refunds in flight, disputes, subscription state. | What the agent remembers or fetched itself. |
| Duplicates and retries | Same action, resource and amount within 72 hours is denied; an idempotency key never executes twice. | Depends on the agent noticing. |
| Approvals | A rule can hold an action for a person, with an expiry. | Not available. |
| Proof | Hash-chained evidence of each check, the decision and the verified outcome. | The conversation log. |
| Bypass | Holds only if the agent’s direct access to the same APIs is removed. | Holds only as long as the model follows it. |

## When rules in the prompt are enough. Said plainly.

- The agent can only read, never move money, so a wrong answer is the worst case.
- Every action already goes through a person who approves it in another system.

## Questions teams ask when they compare.

**Do I still need instructions in the prompt?**

Yes: they make the agent ask for the right things. Audon decides whether the action may run. A denial comes back with a code and a reason the agent can relay to the customer.

**Does it work with any model or framework?**

Yes. Audon controls the actions, not the model: the agent calls integrity.execute from the SDK or the Action Gateway over MCP, whatever model it runs on.

The products

- [Agent Action Control](https://audon.ai/product/agent-action-control) : Checks every refund, credit, discount or subscription change an AI agent makes before it runs, verifies the outcome and keeps the evidence.

Sources

- [OWASP Top 10 for Large Language Model Applications (prompt injection)](https://owasp.org/www-project-top-10-for-large-language-model-applications/)

Last updated 2 November 2026

## Every action checked. Every outcome on record.

[Start action auditFree](https://audon.ai/sign-up?intent=integrity) [See a sample report](https://audon.ai/sample-report)