In my empirical experience, the agent generally follows the protocol as hard constraints. I tried it mostly with Opus and sometimes with GPT5.5. 99% of the time it works as expected. I believe this works because guidelines are redundant enough to allow it to self correct.