Instructed or enforced: one page to read before you let AI near a workflow
The one question that separates a system you can trust with your paperwork from one you cannot, and ten ways to ask it of any vendor, including us.
Published 2026 10 07
Blackthorn Labs is an applied research firm with a business services focus. It builds systems whose constraints are enforced in code rather than instructed, and installs them inside operating businesses. This page is the short version of that sentence, written for the owner or office manager who is about to let a system act on the firm's behalf and wants to know what to ask first. It is free to keep, whoever you end up working with.
Every rule a system is supposed to follow lives in one of two places. It is either instructed, meaning written into the prompt or the settings as a sentence the system is asked to obey, or it is enforced, meaning written as code that runs before the system can act and stops it when the rule would be broken. An instructed rule is a request. An enforced rule is a wall.
The difference does not show on a demo. It shows on the day the input is strange, the pressure is on, and the sentence in the prompt is the only thing between the system and a mistake with your name on it. Ask, of every rule that matters: where does this one live?
1. Show me the rule as code, not as a sentence. If the answer is a paragraph of instructions, the rule is instructed. If it is a function with a name, you are looking at enforcement. 2. Show me the test that feeds it the bad input. A rule that has only been tried with good input has not been tested. Ask to see the case where someone fed it exactly the thing it exists to refuse. 3. Show me the test that proves it still lets the right things through. The second half most vendors skip. A rule that refuses too much fails quietly in the other direction. Ask for the case that must still pass. 4. What does a refusal look like? A good one carries a name, the reason in plain words, and what would fix it. A bad one is silence, or a system that does the thing anyway. 5. Which numbers does it report, and what keeps each one honest? Every headline number can be gamed on its own. Ask which second number is reported beside it, every time, by rule rather than by habit. 6. What is the minimum amount of evidence before it draws a conclusion? A system that recommends after three examples is guessing. Ask for the number, and ask whether it is written down somewhere the system cannot change. 7. What leaves the building without a person approving the exact text? Approval of a sentence is not approval of a different sentence. Ask whether the system can send anything that was edited after someone said yes. 8. What can it never see? Card numbers, bank details, government identifiers. Ask whether the refusal is a policy or a function, and whether the test for it exists. 9. What is it forbidden to say about a person? A missed payment is a fact about an invoice. A judgment about someone's willingness to pay is a different thing, and a system that forms it will eventually say it. Ask what stops that. 10. When it was wrong, where is that written? A rule is not finished when it works. It is finished when the way it once failed is recorded next to it. Ask to see the record.
Count how many of the ten came back as code with a test. That count is the honest measure of how much of the system is enforced and how much is hoped for. There is no right number for every office. There is a right number for yours, and it is the number of rules whose failure you could not afford.
If a vendor cannot answer the first three, the rest do not matter yet. If they can answer all ten, you are talking to engineers, and the conversation that follows is about which rules you want, which is the conversation worth having.
We ask these questions of our own systems before anyone else does. The firm's sales desk agent answers all ten in one file of code, and the first note in our series shows the answers one at a time with the test beside each. The series is at blackthornsec.com/notes.
If you want a first read of where these questions land in your own office, the firm offers a thirty minute call. No charge, no pitch. You leave with a first read and a plain next step.