Untrusted by default: five rules that keep an agent from obeying the wrong text