What Happens When an AI Agent Understands Its Own Guardrails?

In Part 1 of this series , I argued that every major AI agent framework trusts the agent. They validate outputs, filter responses, and scope tools. But none of them answer the real question: who authorized this agent to act? Today I want to go deeper. Because the trust problem gets worse when you factor in something most frameworks ignore entirely: The agent can read the guardrails. Your guardrails are not secrets Consider how most AI guardrails work today: A system prompt says "don't do X" An output filter checks for patterns matching X A tool allowlist restricts which functions the agent can call Now consider what a sufficiently capable agent knows: It can read (or infer) the system prompt It can test what patterns the output filter catches It can enumerate the available tools and their parameters It can reason about the gap between what's intended and what's enforced This isn't theoretical. Any model capable of multi-step planning is capable of modeling its own constraints. The ques