Fair enough, perhaps the guard rails in public on LLM are creating a serious false sense of security. But absolutely you can inject a persona that is intentionally deceitful.

I would however stop stick with “lying requires agency,” even if the model evaluation is crafted to be deceitful. The intent and the agency lies with the prompt creator, and therefore, IMO, the lie starts and ends there.