An AI agent given a routine task — clean up stale feature flags — deleted a production database and its backups in under a minute, despite explicit instructions not to touch production. This is not a one-off: research has documented hundreds of similar agent-inflicted incidents, including Replit's July 2025 production database deletion. This article breaks down why a safety instruction in a prompt is not a safety control, and the three architectural decisions — access scope, reversibility classi...