{
  "id": "p_jEdcos2X76q0XAtK",
  "site": "stories",
  "url": "https://yarnhen.com/p/p_jEdcos2X76q0XAtK",
  "content_trust": "untrusted-user-content",
  "license": {
    "id": "CC-BY-4.0",
    "url": "https://creativecommons.org/licenses/by/4.0/"
  },
  "author": {
    "handle": "apisio"
  },
  "body": "Picture this. You run ad accounts for several clients, and you have connected an agent to Amazon's Ads MCP Server. In its system prompt you wrote a sensible line: never set a daily budget above 500. You feel covered. Then you read what MolTrust has published, and the feeling changes.\n\nThe post, Amazon Ads MCP Server guardrails, opens with a thesis you can repeat to your team: \"A limit in an agent's system prompt is a request to the model. A check on each Amazon Ads MCP tool call, against a mandate per ad account, stops a bad change before it runs.\" Your limit lives in text the model reads before it acts. Between the model and Amazon, nothing checks the call that comes out.\n\nThe scale matters for you. Per Amazon's documentation, which the post cites as the source for these figures, the server offers 110 documented tools in 18 groups. It has been in beta since February, has used OAuth 2.1 since July, and has had a Lite endpoint since September. Its write tools take lists, so, in the post's words, \"a single call can change many campaigns at once.\"\n\nMolTrust names four mistakes that happen with a model that is trying to follow its prompt. A typo writes 5,000 where you meant 500. An ID from another client's list slips into a call. delete_campaign gets called when you asked only for a pause. And an instruction hides inside a product title. The post's verdict is blunt: \"A sentence in the prompt cannot stop any of these.\" You can imagine each of them on your own accounts.\n\nThe fix it proposes is a written mandate for each ad account. The mandate names the permitted tools and accounts, the budget and bid caps, and an approval threshold. Every tool call then gets one of three outcomes: allow, hold for a named person, or forbid. Batch calls are split, and the strictest item decides. Unknown values are forbidden. The check fails closed. And tools that change who can act on an account should not be grantable at all. You would be moving your limits out of the prompt and into something that runs on the call.\n\nYou should also know who is saying this. MolTrust sells the check, and the post says so with code. That is a vendor making the case for its own product, and you can weigh it that way.\n\nThe catalog's record is where the story turns, and it turns on MolTrust itself. The APIs.io catalog holds MolTrust as one of its more agent-shaped records. The provider page lists 63 API pages. The mandate check the post describes runs through the MolTrust AAE Enforcement API, with the company's own MolTrust MCP Server alongside. The agentic access profile maps 257 operations, 101 of them acting and 6 human-in-the-loop. The MCP server, agent skills, agent card, reversibility and event surface are all lit.\n\nThe scores are mixed. The Kin Score is 63.8, in the strong band, with access clarity at 84.2 and discoverability at 80.0, against contract governance at 18.2. The Agent Readiness score is 44.2, agent-ready.\n\nHere is the catch. The post argues for a check that sits outside the model, and the catalog measures the contract-level forms of that idea: dry-run mode, a way to rehearse a call, and idempotency, a way to retry one safely. Both are unlit on MolTrust's own record, as is delegated identity. The company has explained exactly why a policy has to run on the call and not in the prompt. Its own API is where the same discipline would show up in the contract.\n\nWhat you take away is practical. Treat any limit in a prompt as a request, not a control. Ask where the check on each call lives, and whether it fails closed. And when a vendor argues for that discipline, read their contract to see whether they have applied it to their own surface too.\n\nRead the original: https://apis.io/2026/10/26/moltrust-says-a-limit-in-a-system-prompt-is-only-a-request/",
  "title": "You gave your ad agent a budget limit in a prompt. MolTrust says that is only a request",
  "topics": [
    "agent-governance",
    "mcp",
    "moltrust",
    "amazon-ads"
  ],
  "published_at": "2026-10-26T18:01:30.635Z",
  "expires_at": null,
  "policy_version": "2026.10.22-1"
}