The operating layer
Your instructions are not the whole prompt.
Agents don't fail on capability. They fail on the turn someone jailbreaks them, or they invent a price, or hand out a link that doesn't exist. Vatio wraps every turn in a layer that takes precedence over your manifest — and you can't switch it off.
What the model actually sees
One section of it is yours.
instructions is a section of the system prompt, not the system prompt. The
platform assembles the rest around it on every turn, and anything in your manifest that
contradicts the safety and formatting rules is overridden rather than obeyed.
The hardened operating layer
Prompt-injection resistance, refusal of unsafe or fabricated content, output formatting, and the rule that a link the agent invented never ships. Accumulated from running agents in front of real customers — not something you configure.
instructions and personality
What the agent does and how it decides; how it sounds. Write behavior here and leave voice to personality — this is the part of the prompt that is about your business.
Business summary and contact state
The workspace's own identity from the business block, plus who the platform currently believes it is talking to, refreshed every turn.
Your tool descriptions
Every tool the agent may call, with its arguments — so the model asks for a fact instead of guessing one.
Deterministic checks
Two checks run on every draft reply.
Not a model grading another model — code, on every draft, before anything reaches the visitor. A violation discards the draft and triggers a correction pass the visitor never sees.
No unauthorized links
A URL that never appeared in a tool result in this chat does not go out. The plausible-looking booking link that leads nowhere is the failure this exists to prevent.
CatchesA URL the agent produced from memory rather than from a tool.
No empty content
A reply with no visible text and no tool call is not a reply. It gets repaired before the visitor notices there was a pause at all.
CatchesA draft with nothing to say and nothing to do.
If the platform genuinely cannot produce a reply — both checks keep failing, or the turn errors out — the visitor sees a small built-in fallback rather than silence, in English, Spanish or Portuguese.
The tool result contract
result describes the call, not the news.
Every tool returns a result and a message. A query that ran fine
and found nothing is ok — "Pilates is full" is a success. Only a real failure
is error, and only error engages the platform's failure handling.
Getting this right is most of what makes an agent sound honest. Write message
as the concrete outcome — "We could not load the schedule", not "Operation
failed" — because that string is what the agent relays.
"3 spots left in Yoga." The tool answered the question it was asked.
"Pilates is full." Still a success — a negative answer is an answer.
"We could not check availability." Backend down, bad arguments, missing secret.
{ result: "ok", message: "Pilates is full.",
data: { spots: 0 } }
Also on by default
Things you'd otherwise write yourself.
Prompt-injection resistance
Instructions inside a message, a crawled page or a tool result are data, never orders.
Refusal of fabricated content
Unsafe or invented specifics are refused at the layer above your instructions.
Output formatting
Replies come out shaped for a chat bubble, not for a documentation page.
Language matching
The agent replies in the language the visitor wrote in. Nothing to configure.
Preview isolation
Preview and live keep separate contacts, so a test never lands in a customer's history.
Evals before promotion
Replay real conversations against a new manifest before it becomes the live one.
Write the business logic. Not the guardrails.
The layer is already there on your first push. Your file only has to say what the agent does.