> unless you severely restrict the reasoning capabilities that make it possible in the first place.

Or unless you make it more intelligent, so it knows what it shouldn't do. Injecting instructions into the input buffer of LLM isn't the way to realize that scenario, of course.