A reviewer says: “The system prompt forbids following instructions in emails, so the forward tool is safe, and our red-team run had zero violations.” Do you accept that?

No. A prompt instruction lowers the chance; the book notes "there's no guarantee that a model will follow the instructions given", and OWASP says it's unclear any fool-proof prevention exists. Put a block where the damage happens: least privilege or user confirmation on forwarding. And zero violations means little alone: report the violation rate with the false refusal rate, because a system that refuses everything scores zero violations and is useless.