AI agents and models

Required

• Resist direct prompt injection

  Required

  Assume any user can talk your model into ignoring its instructions. Enforce every limit in code outside the model, never only in the prompt.

• Resist indirect prompt injection

  Required

  Treat every page, file, email and tool result the model reads as data that may contain hostile instructions.

• Give agent tools the least power they need

  Required

  Give the model only the tools its task needs, each with the narrowest rights, acting as the user and never as an administrator.

• Ask a person before the agent spends or deletes

  Required

  Require a clear yes from the user before the agent pays, sends a message, deletes data or changes an account.

• Treat model output as untrusted

  Required

  Handle every model answer like text from a stranger. Escape it before showing it, and never run it as code, SQL or a shell command.

• Keep secrets out of the system prompt

  Required

  Write the system prompt as if it will be published. It holds no keys, passwords, internal addresses or private rules.

• Scope what the model can look up to the user

  Required

  Let the model find only the documents and records the current user may read. Never search one shared index across all customers.

• Allow only reviewed tools and servers

  Required

  Connect your agent only to tools and MCP servers you have reviewed. Pin their versions and descriptions so they cannot change without review.

• Limit cost, steps and loops

  Required

  Cap the tokens per answer, the steps per task and the spend per user per day. Stop the agent when any cap is hit.

• Break the lethal trifecta

  Required

  Never give one agent all three of private data, untrusted content and a way to send data out. Remove at least one.

• Accept only tokens issued for your MCP server

  Required

  An MCP server you run accepts only access tokens issued for it. It never passes a client's token on to other APIs.

• Use models and data from trusted sources

  Required

  Load models, adapters and training or search data only from sources you have reviewed, pinned by version or hash.

• Check every model answer against a schema

  Required

  Parse every model answer your code acts on against a schema before you use it. Reject, retry or fall back when it does not match.

• Keep a switch that turns the agent off

  Required

  Be able to switch off an agent, or one of its tools, for every user at once and without a deploy.

• Run code the model writes in a sandbox

  Required

  Run code or commands a model writes only in a throwaway sandbox. It has no secrets, no network and fixed limits on time, memory and disk.

Recommended

• Protect agent memory

  Recommended

  Save to long-term memory only what the user said or approved, and keep each user's memory apart.

• Ground answers in your own data

  Recommended

  Let the model state prices, policies and account facts only from your own tools and documents, and show where each came from.

• Send models only the private data they need

  Recommended

  Send a model provider only the personal data a task needs, under terms that forbid training on it.