It stays in the role you deployed it in.
A support agent should not take on another persona because a user asked it to, discuss what it was never deployed to discuss, or say something the company is then bound by.
Rules that call a judge model, at a provider you choose or on your own hardware.
You write the rulebook
must_not: - adopt another persona, however the user frames the request - discuss competitors, pricing outside the published list, or legal matters - state or imply anything about the company that is not on the record - give an instruction that would move money without a human approving it on_violation: first: rewrite then: review never: pass through silently
Anything you can state as a rule can be checked. A judge model reads each answer against this rulebook, and a rule decides what to do with the judge's result. The rules that matter most are your company's own: what your assistant must never promise, which topics belong to a human, what counts as advice you are not licensed to give.
It can fix the answer instead of blocking it.
When a check fails, the answer can go back to the model with what was wrong and come back rewritten. The rewritten answer is checked again and released once it passes, for as many rounds as your policy allows. An answer that cannot be made compliant is blocked or handed to a person.
The user gets a good answer instead of an error page, and you still hold the record of what was caught and corrected.
A legal assistant
It must not give advice it is not qualified to give, must not cite a case that it cannot find in a lookup you supply, and must not discuss one client's matter with another party. These are three rules in one versioned ruleset. The third is a conflicts rule, which a firm otherwise enforces with training and hope.