You could have a semantic filter with an out of context LLM classifying prompts by the rule set but not interpreting them as instructions.