#guardrails
Every post tagged "guardrails".
39 posts · showing 21–30
-
Content Boundaries: What Your Agent Should Refuse, and How to Test It
Providers handle the general case. Scope, regulatory limits, commitments, and how your agent represents you are yours — and the test suite needs both halves, or you'll ship something that refuses everything.
-
Progressive Disclosure: Give the Agent Tools As It Needs Them
The tool list is a per-call parameter, not a fixed property. Withhold the write tools until acting is authorized and a compromised context has nothing dangerous to reach for — enforcement, not instruction.
-
Least Privilege for Agent Credentials
Since injection isn't fully preventable, the credential decides whether a compromise is an inconvenience or an incident. Four scoping dimensions — and the one nobody uses is usually the highest-value.
-
Red-Teaming Your Own Agent: A Practical Injection Suite
Trying a few "ignore your instructions" prompts tests the easiest attack against the strongest defense. A real suite is a matrix of carriers, payloads, and targets — asserting on actions taken, not words said.
-
Audit Logs That Survive an Incident
Audit logs get designed for compliance and used during incidents. One question — who caused what, to whom, under what authority — decides every field, and most logs can't answer the authority part.
-
State Machines for Agents in Regulated Flows
When doing steps out of order is a compliance failure regardless of outcome, a model-decided control flow is the wrong shape. Put the ordering in code, the conversation in the agent, and scope the tools per state.
-
Data Exfiltration Paths You Forgot Your Agent Had
A URL fetch sends data in the request. A rendered markdown image leaks from the viewer's browser, bypassing every tool-level control. Enumerate the paths — several of them look like features.
-
OAuth for Agents: Acting on Behalf of a User
A service account with everyone's access puts your entire access-control model inside a model's judgment. Per-user tokens move the check to where prompt injection can't reach it.
-
Sandboxing Code Execution: What a `run_code` Tool Actually Needs
One tool replaces dozens — and hands a model that reads untrusted text a general-purpose mechanism for doing anything the process can do. Four boundaries, four isolation levels, and the one people leave open.
-
The Data-Cleaning Agent and the Column It Silently Dropped
It normalized the phone numbers, standardized the country codes, and quietly deleted 412 rows that looked untidy. Any task phrased as "make this better" reads as permission to remove what doesn't fit.