Guardrail prompts are advice, and advice is exactly what a prompt injection overwrites. If an agent's only defense is a system prompt that says "never wire money without approval," an attacker who controls any text the agent reads can talk the model out of it. The fix is to move the decision out of the model and into a deterministic gate that runs before any action executes.

Protocol One's acp_engine.py (v3.1.0) is a zero-dependency Python engine that does this. It evaluates a proposed agent action against a pre-deterministic truth table and returns exactly one of three outcomes: ALLOW, HOLD, or DENY. The same inputs always produce the same output, nothing is sampled, and no model sits in the decision path, so injected text has nothing to persuade. HOLD routes the action to a human, whose approval is bound to the exact action with an HMAC-SHA256 token.

The second piece, aip_v3_builder_and_verifier.py, builds and verifies self-sealed SHA-256 domain index records, so anyone can check offline that a published AI index page has not been altered. Like the engine, it needs only the Python standard library.

Try it yourself:

Because both tools are plain Python files with no dependencies, you can read them in one sitting, audit them, and run them in CI before an agent is allowed to touch production systems.