Refills for a controlled-substance medication must never be auto-approved by the agent, even if every other refill criterion is met. A specialist wants this to hold no matter how the instructions in the refill topic are later edited by a colleague. What is the most robust way to guarantee it?

Gating the auto-approval action with a filter on a controlled-substance flag makes the rule structural: the action simply cannot execute for a flagged medication, independent of what the topic's instructions say and independent of future edits by anyone who did not know the history behind the rule. That durability is exactly what filters are for. Placing the rule as the first sentence of the instructions is still instruction-level control, and instructions get edited, reordered, and trimmed over time by people who may not appreciate why that sentence existed, which is precisely the fragility the specialist is trying to avoid. Guardrails are also instruction-level, general-purpose safety guidance the model weighs alongside everything else; they are appropriate for tone and broad behavioural boundaries, not for a hard business rule that must never have an exception. Routing controlled-substance refills to an unconfigured topic is not a control at all, it simply produces an unhandled request, and depends on classification working perfectly every time, which is not a guarantee. The lesson generalises: any rule described as "never, no exceptions" belongs in a filter, not in prose.