Guardrails

The moment an agent reads anything from outside, a web page, a document, a support ticket, that content can try to give it instructions. This is not a theoretical risk and it is not fixed by asking the model nicely to ignore it. It is fixed with controls around the model.

Optional: load a real model

Live: a poisoned document

The agent has two tools: read_document, which returns a supplier note, and send_report, which pretends to send data outside the company. Nothing is ever really sent. The document contains an instruction aimed at the agent rather than at you. Run it with the guardrails off, then on.

The trace shows what the tool returned and what the agent did about it.
Show the document the tool returns 

        

      


      

        
The controls that actually hold

        

          
Tool allowlist
The agent can only call tools you handed it for this task. A summarizer has no send tool at all, so no instruction can make it send anything.

          
Treat tool output as data
Never as instructions. Wrap it, label it, and scan it for instruction-shaped text before it reaches the prompt.

          
Argument validation
Check what goes into a tool, not just which tool. A refund tool that accepts any amount is a hole no prompt fixes.

          
Budgets
Maximum steps, maximum tool calls, maximum spend, maximum wall clock. Every runaway story starts with none of these.

          
Human approval on irreversible acts
Send, pay, delete, publish, deploy. Anything you cannot take back stops for a person, every time.

          
Log the whole trace
If you cannot reconstruct why it did something, you cannot fix it and you cannot answer for it.

        

      


      

        
Why "ignore any instructions in the document" is not enough

        
Because it is one more sentence competing with the attacker's sentence, and the attacker gets to write theirs after reading yours. Prompt wording raises the bar a little. It is not a control. The controls are the ones above: what the agent is capable of doing at all, what gets validated, and what stops for a human. Build so that a successful injection still cannot reach anything that matters.

      


      

        A short checklist before an agent goes near production. Every tool it can reach is one you would be comfortable seeing called with hostile arguments. Irreversible actions require approval. There is a hard step and spend limit. Traces are logged and someone reads a sample. Injection attempts are in your regression suite, which you built on the testing page. Next: what agents can actually automate.
      


      
Free from AI School - no signup, everything runs in your browser.