The load-bearing distinction: programmatic enforcement (hooks, prerequisite gates) versus prompt-based guidance. When a rule tolerates zero exceptions — verifying identity before any financial operation, say — prompt instructions carry a non-zero failure rate no matter how many times, how prominently, or with how many few-shot examples the rule is restated. If a single violation is unacceptable, it cannot live in the prompt. That single sentence resolves most of this task statement's scenarios.
Prerequisite gates block a downstream tool until an upstream step has actually completed — e.g., blocking a refund tool until an identity-verification tool has returned a confirmed result. This is deterministic in a way no amount of prompt emphasis can be.
Structured handoff protocols matter because the human receiving an escalation cannot see the conversation transcript. A handoff needs to carry identifiers, a root-cause summary, amounts, and a recommended action — "please see the conversation for context" is not a handoff, it's a dropped ball with extra steps.
Multi-concern requests — one message raising several distinct issues at once — get decomposed into distinct items, investigated in parallel against shared context, and synthesized into one unified resolution, rather than handled as one undifferentiated blob that risks addressing only the first-mentioned concern.
Traps worth naming explicitly: "strengthen the system prompt," "add emphasis," and "add few-shot examples of the rule" are all still probabilistic fixes to a determinism problem. Post-hoc auditing that detects violations after the fact is not the same as a gate that prevents them. And a routing classifier that changes which tools are available addresses tool availability, not tool ordering — a distinct problem with a distinct fix (a prerequisite gate).