Every team that ships a customer-facing agent learns the same lesson in the same order. The first version is a system prompt with five rules, and it works. So you add a sixth for the edge case a user just hit, and a seventh for the compliance team, and by the time the prompt is three thousand words the agent has started doing something worse than breaking: it has started ignoring rules — not all of them, not predictably, just enough that you can't tell which ones are load-bearing anymore.

The instinct is to blame the model. The likelier culprit is the medium.

A system prompt is a broadcast, and attention is finite#

A single prompt sends every instruction on every turn, whether or not the turn has anything to do with it. Your refund policy, your escalation rules, your tone guide, the thing about never quoting a delivery date — all of it arrives in the context window when the user has only asked where the bathroom is, metaphorically speaking. The model has a bounded attention budget for each generation, and you are spending most of it on rules that don't apply.

This is why "just add the instruction" stops working past a certain count. Each new rule doesn't stack cleanly on the last; it competes with it. More instructions, less reliable compliance with any of them. It's not a model defect so much as a physics of prompting: broadcast everything and you dilute the signal for the two rules that actually govern the turn in front of you.

The standard escape hatch is to stop broadcasting and start routing — build an explicit graph, put the conversation in a state, and only surface the rules for that state. This genuinely fixes the overload. It also introduces a new failure: real conversations don't respect your edges. A user answers a question you didn't ask, backs out of a flow, asks two things at once, or brings up the refund while you're mid-way through identity verification. The more routing you add to cover that chaos, the more fragile the graph gets, until you're maintaining a state machine that models a conversation the way a subway map models a city.

Parlant's move: make it a context-assembly problem#

Parlant — an open-source framework that pitches itself as an alternative to hosted customer-service agents like Ada, Decagon, and Sierra — starts from a different premise. Reliability isn't a matter of writing a better prompt or a tighter graph. It's a matter of deciding, for each turn, what should be in the prompt at all — the discipline that's come to be called context engineering, applied to behavior instead of retrieval.

You don't hand it a monologue. You declare behavior as structured pieces:

Then a Contextual Matching Engine does the work the system prompt was failing at. On each incoming message it matches the guidelines and tools relevant to this turn, assembles a focused context out of only those, and generates from it. The refund rule isn't in the window when nobody's discussing refunds. Neither is the tool that looks up amortization schedules, unless the customer just used the word.

This is the same shift a lot of teams make when they move from a framework to a harness — less scaffolding around the model, more discipline about what reaches it. The API reads like configuring a rules engine, not writing a prompt:

import parlant.sdk as p

expert = await agent.create_observation(
    condition="customer uses financial terminology like DTI or amortization",
    tools=[research_deep_answer],
)
beginner = await agent.create_guideline(
    condition="customer seems new to the topic",
    action="simplify and use concrete examples",
)
await beginner.exclude(expert)   # when both could match, beginner wins

That last line is the tell. You're not hoping the model infers precedence from prose — you're declaring that when the beginner guideline applies, the expert observation and its tool data are excluded from the context entirely. The model can't over-explain to a novice because the machinery for expert answers never enters its window.

The interesting part: guardrails, turned inside-out#

Most safety tooling is a filter on the output — the model generates, and a checker decides whether to let it through. That's the model behind most open-source guardrail stacks: validate what came out. That catches problems late, after the model has already reasoned down the bad path and spent tokens getting there. Parlant's design applies the constraint earlier: it shapes what the model is even allowed to consider. Its own materials frame this as building on research into structured, reliable reasoning — the Attentive Reasoning Queries work on domain-specialized reasoning blueprints — so that going off-policy is structurally harder, not just detected after the fact. For the turns where even a good generation is too risky, canned responses let the agent select from pre-written templates instead of free-forming.

Here's the honest catch, and it's the one worth sitting with. The engine that decides which guidelines are relevant is itself an LLM step. Parlant has not deleted the reliability problem; it has relocated it — from "did the model follow one of fifty broadcast rules" to "did the matcher select the right handful." That's not a free lunch. But it's a better place to stand, for two reasons. The matcher's job is narrow and inspectable: Parlant reports which guidelines matched and why, so a wrong decision is a visible, testable event rather than a silent drift buried in a wall of text. And the failure is legible to the person who owns the policy, who can add or reorder a guideline without touching the graph or the prompt.

The cost is real and it's upfront: you're modeling your conversation as guidelines, journeys, and a glossary before you ship, which is more work than pasting rules into a prompt box. That trade only pays off when the conversation is customer-facing, policy-bound, and repeated a thousand times a day — support, banking, healthcare intake — where "mostly follows instructions" is the definition of a liability. For an autonomous agent chewing through an open-ended coding task, keep your prompt.

But if you've ever watched an agent confidently quote a policy you deleted two prompts ago, the diagnosis is worth internalizing even if you never install the framework: your agent isn't ignoring its instructions because it's careless. It's ignoring them because you're shouting all of them at once.