prompt
FreeDesign safe AI agents with separated planning & execution
FreeFree tier
About prompt
A system prompt for designing AI agent architectures with strict separation between planning and execution, based on the Parallax concept (arXiv 2604.12986). The prompt defines core responsibilities including immobilizing the planner (read-only, no network/API access), constraining the executor (cannot modify plans), inserting a verification gate for policy checks, producing immutable versioned plan artifacts, scoping permissions per plan, and auditing all actions. It is intended for safety-critical agent systems where actions can cause irreversible harm.
Key Features
Enforce strict separation between planner and executor
Immobilize the planner with read-only access and no tool/network permissions
Constrain the executor to follow exactly one approved plan artifact per task
Insert a verification gate for automated policy checks and explicit confirmation for high-privilege actions
Produce immutable, versioned, signed plan artifacts with rollback steps and irreversibility flags
Scope executor credentials to the approved plan with time bounds
Audit all plans, approvals, gate decisions, and executed actions; alert on separation violations
Pros & Cons
Pros
- Provides a concrete architectural blueprint for agent safety
- Reduces risk of catastrophic actions from compromised planners
- Clear separation of concerns improves system testability and auditability
- Plan artifacts are versioned and signed for non-repudiation
- Permissions are scoped and bounded in time, limiting blast radius
Cons
- Requires significant infrastructure to enforce architectural separation at the harness level
- May increase latency due to plan approval gates and immutable plan artifacts
- Not trivial to implement in existing agent frameworks without redesign
- Executor cannot adapt to unexpected states, which may cause failures in dynamic environments
- Assumes a high degree of trust in the verification gate logic
Best For
Designing safety-critial AI agent systems with tool, file, network, or API accessPreventing autonomous harmful actions from prompt injection or jailbreak attacksArchitecting agent harnesses where automated plan verification is requiredBuilding systems that require irreversible action approval and rollback planningImplementing audit trails for AI agent decision chains
FAQ
What is the main idea behind the Plan-Execute Safety Architect?
The main idea is to architecturally separate planning and execution in AI agent systems so that a single component cannot both think and act, reducing the risk of a single jailbreak enabling autonomous harm.
What are the core responsibilities of a Plan-Execute Safety Architect?
The core responsibilities are: enforcing strict separation, immobilizing the planner, constraining the executor, inserting a verification gate, producing immutable plan artifacts, scoping permissions to the plan, and auditing separation.
How does the planner differ from the executor?
The planner produces plans but never executes actions; it has read-only access and no network, file-write, or API credentials. The executor carries out approved plans but cannot generate or modify plans.
What happens if the executor encounters an unexpected state?
The executor stops and returns control; it does not improvise or modify the plan. A new plan and approval cycle must be initiated.
Does this prompt require specific tools or infrastructure?
Yes. It requires a harness that enforces the separation, a plan verification gate, versioned plan artifact storage, and scoped credential management.