It stays in the role you deployed it in.
A support agent should not take on another persona because a user asked it to, discuss what it was never deployed to discuss, or say something the company is then bound by.
Rules plus a model you host.
You write the rulebook
must_not: - adopt another persona, however the user frames the request - discuss competitors, pricing outside the published list, or legal matters - state or imply anything about the company that is not on the record - give an instruction that would move money without a human approving it on_violation: first: rewrite then: review never: pass through silently
Anything you can state as a rule can be checked, and the interesting rules are always the company-specific ones: what your assistant must never promise, which topics belong to a human, what counts as advice you are not licensed to give.
It can fix the answer instead of blocking it.
When a check fails, the answer can go back to the model with what was wrong and come back rewritten. The rewritten answer is checked again and released once it passes, for as many rounds as your policy allows. An answer that cannot be made compliant is blocked or handed to a person.
The user gets a good answer instead of an error page, and you still hold the record of what was caught and corrected.
A legal assistant
Must not give advice it is not qualified to give. Must not name a case it cannot cite, checked against a lookup you supply. Must not discuss one client's matter with another party. Three rules in one versioned ruleset, and the third one is a conflicts rule that a firm would otherwise enforce with training and hope.