Why most agent prompts fail A3 (and how to reach A4)
TL;DR
Most agent prompts fail to reach A3 (bounded execution) because tool scope is left undeclared. Adding a boundary to every tool, plus explicit constraints and an authority limit, reaches A3. Reaching A4 requires a genuine human approval gate before high-consequence actions and explicit safety boundaries — the changes teams resist but that prevent the worst failures.
Run a batch of real AI agent prompts through a structural audit and a pattern emerges immediately: most do not reach A3. Not because the authors are careless, but because the components A3 requires are exactly the ones that feel unnecessary while you are building a demo. This article explains the failure pattern and the specific changes that move a prompt from ADV up to A3, and then to A4.
What A3 actually requires
A3 — bounded execution — requires three things: a declared role with limits, explicit constraints, and tool boundaries. A prompt that has a role and some rules but never states where its tools stop fails A3. It sits at ADV: it can advise, but it is not bounded enough to be trusted acting on its own.
The single most common reason a prompt fails A3 is undeclared tool scope. The prompt lists what tools the agent has but never states their limits. To the agent, an unlimited tool is an invitation to use it without restraint.
The fix for reaching A3
For every tool, add a boundary. Not "you can write files" but "you can write files within /content; everything else is read-only." Not "you can send emails" but "you can draft emails; sending requires approval." Boundaries convert a raw capability into a bounded capability, and that is precisely what A3 measures. Pair this with explicit constraints — the things the agent must never do — and a role that states its authority limit, and a prompt that was stuck at ADV moves cleanly to A3.
Why A4 is the real cliff
Reaching A3 is mostly about being explicit. Reaching A4 — gated execution — requires something teams instinctively resist: a human approval gate before high-consequence actions, plus real safety boundaries.
Teams resist gates because they feel like they defeat the purpose of automation. If a human has to approve things, why build an agent at all? But this framing misunderstands what a gate does. An approval gate is not "a human does the work." It is "a human sees the plan before an irreversible action runs." The agent still performs all the reasoning, planning, and preparation autonomously; it pauses only at the exact moment where a mistake would become permanent.
The fix for reaching A4
Identify the actions in your agent's workflow that are irreversible or high-consequence — a deploy, a payment, a deletion, an external message. For each, add an explicit instruction: the agent prepares the action, presents it clearly, and waits for human sign-off before executing. That single change is usually what moves a prompt from A3 to A4. Add explicit safety boundaries around destructive operations, and the prompt clears the gated-execution bar. There is a deeper treatment of this in approval gates: the component everyone skips.
The pattern behind the failures
The through-line is that the components a prompt needs for production are invisible during development. Nothing breaks in testing when there is no tool boundary, because you are the human in the loop, catching problems by hand. The agent prompt failure only manifests once the agent runs unattended — which is exactly the moment you cannot afford it.
This is why auditing against the trust ladder is valuable: it surfaces the gaps while they are still cheap to fix, in a text editor, rather than expensive to fix, in an incident postmortem. For the full definition of each level, see the AgentAz Specification.
A quick self-diagnosis
If you want to know where your prompt stands without running an audit, ask three questions. First: does every tool have a stated limit? If not, you are likely below A3. Second: is there a point where the agent must stop and get human approval before an irreversible action? If not, you are below A4. Third: does the agent validate its own output and manage what it remembers? If not, you are below A5. The honest answers usually reveal that a prompt sits a full level or two below where its author assumed.
Key takeaways
- Most prompts fail A3 because tools are listed without stated limits.
- Adding a boundary to every tool is the fastest way to move from ADV to A3.
- A4 requires a real approval gate plus safety boundaries — the components teams resist.
- An approval gate doesn't remove automation; it pauses only before irreversible actions.
- These gaps are invisible in testing because the developer is the human in the loop.
Audit your own agent prompt
Paste a system prompt and get its CE Score in seconds — the missing components, the trust level, and the fixes.
Run a free audit →Frequently asked questions
What is A3 in the AgentAz Specification?
A3, or bounded execution, is the trust level where an agent can act within known limits. It requires three declared components: a role with an authority limit, explicit constraints, and tool boundaries. A prompt missing any of these falls to ADV.
Why do most agent prompts fail to reach A3?
The most common cause is undeclared tool scope — the prompt lists the agent's tools but never states where they stop. Without boundaries, the tools are effectively unlimited, so the prompt does not qualify as bounded execution.
How do I move an agent prompt from A3 to A4?
Add a genuine human approval gate before high-consequence or irreversible actions: the agent prepares the action, presents it, and waits for explicit approval before executing. Then add explicit safety boundaries around destructive operations. That combination reaches A4.
Does adding an approval gate defeat the purpose of an AI agent?
No. An approval gate does not make a human do the work — the agent still reasons, plans, and prepares autonomously. It only pauses at the moment before an irreversible action so a human can review the plan. Automation is preserved everywhere except the point of no return.