The prompt is the only UI many internal agents have. That should make people more careful. Instead it makes them casual.
If a human operator can type anything into a box and the system can spend money, touch data, or write code, that box is an interface. It needs affordances. It needs constraints. It needs error states. The fact that the interface is written in English does not exempt it from design.
The worst prompts are trying to be policy, product spec, and runtime state in one paragraph. They say “be careful” where the product should have a permission boundary. They say “ask clarifying questions” where the workflow should have a required field. They say “do not delete anything important” where the tool should not expose deletion.
The cleaner split
Put durable rules in code. Put permissions in the tool layer. Put user intent in the prompt. Put examples near the edge, not in a global sermon that grows every time the agent fails.
Then test the prompt like an interface: what happens when the user is vague, wrong, impatient, or malicious? If the answer is “the model should figure it out,” you do not have an interface. You have a wish.