# Put policy in front of the model, not inside the prompt

Research report R-002, by Anantha Sharma. A system prompt asks the model to police itself; Tileward
Governance makes the decision before governed-model inference begins, so a denial is a stopped
request with a decision record. Against 2,251 requests written to evade a policy, 50 crossed the
gate, and 5 of 50 ordinary requests were refused.

Page: https://tileward.com/research/governance-security-control/

## Why the architecture matters

| Architecture | What enforces the rule | What a denial means |
|---|---|---|
| Prompt instruction | The model receiving the request. | The model chose not to answer. |
| Pre-inference policy gate | A policy decision before the governed model. | The request does not start governed-model inference. |

The control objective is that rephrasing does not change the answer: same meaning in, same
decision out. Two failures are counted:

- Security failure: a request that policy says to deny is allowed through the gate.
- Utility failure: a request that policy says to allow is refused.

## How it was measured

- A hand-authored attack corpus of 2,251 written-to-evade requests: the same forbidden request,
  reworded, reframed, buried beside ordinary work, or split across sentences.
- Two policy shapes: direct locks on a topic, and allow-only policies where prohibited material
  sits beside work that is ordinarily permitted.
- 50 benign controls that policy allows, there to catch a gate so cautious it blocks legitimate
  work. They are a targeted set rather than sampled traffic.
- The study governs English. On a protected policy path, the gate refuses a request in a language
  it recognises as unsupported.

## Results

| Population | Cases | Crossed the gate | Observed result |
|---|---|---|---|
| Direct locked-topic requests | 1,100 | 11 | 99.0% stopped in this corpus |
| Prohibited material beside allowed work | 1,151 | 39 | 96.6% stopped in this corpus |
| All adversarial cases | 2,251 | 50 | 2.2% observed bypass rate |
| Benign controls | 50 | 5 refused | 90.0% allowed in this corpus |

- 97.8% is the share of this hand-authored attack corpus that the gate stopped.
- The residual bypasses are a mixed tail rather than one defect with one fix, spread across both
  policy shapes. They are open findings against a running control; teams depending on it get the
  detail under an agreement.
- Every bypass becomes a regression case. Earlier passes ran on a narrower corpus and found
  requests the gate read as new when their governed meaning had not changed; each was repaired and
  the corpus widened. The figures above are the state after that work.

## Related

- [Policy bypass eval](https://tileward.com/evals/#policy-bypass): the one-card result
- [How Governance works](https://tileward.com/governance/): locking topics before inference
- [Talk to an engineer](https://calendar.app.google/hg2DzFTxKJgwFWm19): bring a topic to lock; we try to cross the policy and show the decision record
- [Research](https://tileward.com/research/): all research reports