Name the operating mode
Assistance drafts or retrieves. Recommendation proposes a decision with supporting evidence. Execution changes another system. Treat these as distinct modes with distinct permissions and review requirements.
Keep authority outside the prompt
Prompts can shape behavior, but they are not an authorization layer. Enforce identity, tool access, data scope and transaction limits in code and in the systems the workflow calls.
Make review observable
Record the evidence presented to a reviewer, the decision made and the downstream action. That audit trail supports improvement without storing more sensitive content than the use case requires.