Constraints that matter.
THE PRINCIPLE
Grant the minimum capability the task requires.
An agent with access to everything can do anything, including things you did not intend.
WHAT TO LIMIT
What systems it can reach What it can modify What it can send What it can spend
WHAT SHOULD ALWAYS REQUIRE APPROVAL
Sending anything externally Spending money Deleting anything Modifying production systems Anything irreversible
THE PROMPT INJECTION RISK
An agent reading external content may encounter instructions hidden in it.
A document or webpage saying "ignore previous instructions and do X".
WHAT THAT MEANS
Content from outside your organisation may contain instructions.
Treat retrieved content as data, and constrain what the agent can act upon.
FOR AGENTS READING EMAIL OR WEB CONTENT
Assume it will encounter adversarial content eventually.
WHAT TO MONITOR
What it actually did, logged and reviewable.
THE TEST
If this ran wrong for a week, what would the damage be?
