Well, prompt injections work precisely because they can sometimes successfully imitate user role, right? Role separation is a trained behavior, not a security boundary.
They could probably make a separate tool for setting this, that would always initiate a harness prompt (i.e. disregarding the currently set mode).
They could probably make a separate tool for setting this, that would always initiate a harness prompt (i.e. disregarding the currently set mode).