Give the assistant one job
Four places an AI feature is fenced to a single job, and what each fence is made of.
Jessie's tutor can list and read files in one public repository. It never runs code, awards a badge or changes a role. The TSU team bot's prompt forbids it from writing the team's documents, so it outlines, reviews and asks questions instead.
JamScript's assistant proposes a change as a diff, and nothing in the document changes until the user accepts it. If its answer is interrupted, it reports the interruption instead of splicing a second model's reply into a stream that had already started. The travel agent from the HIGGS program pauses for a person's approval.
In each case the limit lives in the tool the assistant is given, not in a request to behave. A prompt can be argued with. A tool that can only read cannot.