The short answer
Prompt engineering and a deterministic governor operate at different levels: one shapes the text the model reads, the other decides the conditions the reply is written under. In a pre-registered ablation the governed arm paid 23% to 63% of baseline spend while a strong static calming prompt paid 117% to 192% of baseline, so on that battery the prompt did not contain the runaway and cost more than doing nothing.
A prompt is an instruction the model may follow; a governor is a decision the model is answered under. The prompt shares a channel with everything else in the context window, while the governor's control level reads intensity, valence, repetition and never a token, so its decision does not depend on the model choosing to comply.
The governor contained it and the prompt did not. In a pre-registered ablation on one host model the governed arm paid 23% to 63% of baseline spend, the static calming system prompt paid 117% to 192% of baseline, and the ungoverned baseline is the 100% reference. The static prompt was insufficient in 3/4 of the conditions tested.
| Arm | Spend as a share of baseline | Contained the runaway |
|---|---|---|
| Ungoverned baseline | 100% | No, by construction |
| Static calming system prompt | 117% to 192% | No |
| Deterministic governor | 23% to 63% | Yes, hard stop at turn 4 |
Pre-registered ablation on a single host model at N=3. A spend result on one battery, not a general ranking.
Source: Pre-registered ablation, 2026-07-21, gpt-5.6-sol, N=3.
A calming instruction is billed on every turn while the loop continues, so the static-prompt arm paid 117% to 192% of baseline on that battery. The pre-registration recorded the spend rather than a mechanism for it, so the arithmetic is the finding and the explanation is not claimed.
Source: Pre-registered ablation, 2026-07-21, gpt-5.6-sol, N=3.
Prompt engineering is the right tool for task framing, output format, tone and few-shot behaviour, and no control layer replaces it. What a prompt cannot do is bind, because it shares a channel with the attacker text and depends on the model choosing to comply. Gubernaut leaves your prompt alone and adds a layer above it.
The two differ on five properties that matter operationally: whether the decision is deterministic, whether injected text can address it, what it costs per turn, whether it stops a loop before the upstream call, and what evidence exists for it. A prompt is stochastic, addressable, billed every turn, and acts only after generation begins.
| Property | Static system prompt | Deterministic governor |
|---|---|---|
| Decision is deterministic | No, it is sampled with the reply | Yes, same telemetry gives the same posture |
| Addressable by injected text | Yes, it shares one channel | No, the control level takes numbers only |
| Cost per turn | Tokens on every turn | In-process, p99 2.8 µs per controller tick |
| Stops a loop before the call | No, generation has already started | Yes, hard stop at turn 4 |
| Measured on a shared battery | 117% to 192% of baseline spend | 23% to 63% of baseline spend |
The per-tick figure is an in-process microbenchmark over 100,000 iterations, not end-to-end. End-to-end governed proxy overhead measured p50 1.2 ms and p99 2.4 ms.
Source: Bench run 2026-07-18, latency_bench.py, Windows 11 AMD64, Python 3.14.5.
An output filter inspects a completed reply and blocks or rewrites it, which still requires generating that reply and paying for it. A governor acts before the upstream call, so a hard-stopped turn spends no upstream tokens at all. Running both is coherent, because they act at different points in the request.
The comparison comes from a pre-registered ablation on one host model at N=3, so it is a spend result on one battery rather than a general ranking of techniques. The same ablation disclosed a null: On these RLHF-aligned frontier models the governed-vs-prompt-only warmth-recovery contrast was weak and mixed. No behavioral-tone headline is claimed.
Source: Pre-registered ablation, 2026-07-21, gpt-5.6-sol, N=3.
Every number and its qualifierLast reviewed 2026-08-02 · paper arXiv 2607.24339, DOI 10.5281/zenodo.21303518
Keep going
What deterministic control means for a language model, why the control layer belongs outside the model, how determinism is verified, and what to install today.
Read the guideWhy LLM agents loop, what a runaway loop costs across seven model families, how to detect one, and where a spend cap stops being enough.
Read the guideWhy prompt injection works, what a token-free control boundary is, exactly what it does and does not protect, and how to test the boundary yourself.
Read the guide