The operating layer

Your instructions are not the whole prompt.

Agents don't fail on capability. They fail on the turn someone jailbreaks them, or they invent a price, or hand out a link that doesn't exist. Vatio wraps every turn in a layer that takes precedence over your manifest — and you can't switch it off.

What the model actually sees

One section of it is yours.

instructions is a section of the system prompt, not the system prompt. The platform assembles the rest around it on every turn, and anything in your manifest that contradicts the safety and formatting rules is overridden rather than obeyed.

Platform

The hardened operating layer

Prompt-injection resistance, refusal of unsafe or fabricated content, output formatting, and the rule that a link the agent invented never ships. Accumulated from running agents in front of real customers — not something you configure.

Yours

instructions and personality

What the agent does and how it decides; how it sounds. Write behavior here and leave voice to personality — this is the part of the prompt that is about your business.

Platform

Business summary and contact state

The workspace's own identity from the business block, plus who the platform currently believes it is talking to, refreshed every turn.

Platform

Your tool descriptions

Every tool the agent may call, with its arguments — so the model asks for a fact instead of guessing one.


Deterministic checks

Two checks run on every draft reply.

Not a model grading another model — code, on every draft, before anything reaches the visitor. A violation discards the draft and triggers a correction pass the visitor never sees.

No unauthorized links

A URL that never appeared in a tool result in this chat does not go out. The plausible-looking booking link that leads nowhere is the failure this exists to prevent.

CatchesA URL the agent produced from memory rather than from a tool.

No empty content

A reply with no visible text and no tool call is not a reply. It gets repaired before the visitor notices there was a pause at all.

CatchesA draft with nothing to say and nothing to do.

If the platform genuinely cannot produce a reply — both checks keep failing, or the turn errors out — the visitor sees a small built-in fallback rather than silence, in English, Spanish or Portuguese.


The tool result contract

result describes the call, not the news.

Every tool returns a result and a message. A query that ran fine and found nothing is ok — "Pilates is full" is a success. Only a real failure is error, and only error engages the platform's failure handling.

Getting this right is most of what makes an agent sound honest. Write message as the concrete outcome — "We could not load the schedule", not "Operation failed" — because that string is what the agent relays.

ok

"3 spots left in Yoga." The tool answered the question it was asked.

ok

"Pilates is full." Still a success — a negative answer is an answer.

error

"We could not check availability." Backend down, bad arguments, missing secret.

tools/check_availability.js returns
{ result: "ok", message: "Pilates is full.",
  data: { spots: 0 } }

Also on by default

Things you'd otherwise write yourself.

Prompt-injection resistance

Instructions inside a message, a crawled page or a tool result are data, never orders.

Refusal of fabricated content

Unsafe or invented specifics are refused at the layer above your instructions.

Output formatting

Replies come out shaped for a chat bubble, not for a documentation page.

Language matching

The agent replies in the language the visitor wrote in. Nothing to configure.

Preview isolation

Preview and live keep separate contacts, so a test never lands in a customer's history.

Evals before promotion

Replay real conversations against a new manifest before it becomes the live one.

Write the business logic. Not the guardrails.

The layer is already there on your first push. Your file only has to say what the agent does.