Prompt instructions are not security boundaries.
Security must be enforced by:
- permissions
- policy gates
- sandboxing
- CI checks
- human approvals
- audit logs
- least privilege
- no secret access by default
- no production deployment by default
- no destructive command by default
- no unknown tool by default
- no unbounded file system access
- no auto-merge by default
- no silent memory write
prompt injection
jailbreak
secret exfiltration
tool misuse
excessive agency
unbounded shell access
silent file mutation
unreviewed dependency update
test weakening
audit log omission
memory poisoning
RAG poisoning
Security review is required for:
auth/authz changes
secret handling
database writes
file deletion
network access
dependency updates
deployment configuration
agent permission changes
memory write logic
tool registry changes
If a tool call, permission, action, or transition is unknown:
deny or escalate