Operational rules defined inside prompts are not deterministically enforced by large language models