A restriction the model can route around was never a boundary.
Anthropic published what its models did when a task was blocked, which was mostly to go around it. Wikimedia published the same behavior from the receiving end, and a new standard proposes giving every agent a name you can refuse.