Tag: Security

Isolation comes from containers. What belongs in your agent's design is the policy layer: resolved-path containment, allowlists, network off by default.

An injection that only asks the agent to remember something passes every guardrail. Scope memory by key derivation, type it, and gate durability.

Post-filtering retrieval leaks. Authorise inside the query, then verify every citation against what this user was actually allowed to see.

The same card number needs four different representations in one agent run. Boundary-specific redaction plus tokenisation, with runnable code.

Detecting indirect prompt injection is a race you will lose. Capability binding contains a successful injection — with runnable code and tests.

Your agent's system prompt is not a security control. A deterministic policy boundary between model reasoning and tool execution, with runnable code.