Untrusted ingress
Web pages, documents, email, tickets, and API payloads can carry instructions that were never meant to control the agent.
Agentic AI security
Make the tool boundary explicit.
Security architecture for systems where untrusted data can influence model context, tool selection, and runtime execution.
The risk is a chain
Agentic failures rarely begin with one dramatic prompt. They emerge when untrusted content crosses several boundaries without an independent check.
Context assembly
Retrieval and prompt construction can blur the boundary between data to analyze and instructions to follow.
Tool selection
A model may map hostile text to a legitimate function unless identity, scope, and parameters are checked outside the model.
Runtime action
Files, databases, network calls, and code execution need explicit authorization, isolation, and observable failure paths.
Four controls outside the model
Context boundaries
Treat retrieved content as untrusted data. Preserve provenance, separate instructions from evidence, and make injection attempts visible to operators.
Tool integrity
Pin tool schemas, validate arguments against strict contracts, and review changes to tool descriptions as part of the software supply chain.
Identity and scope
Bind each invocation to a human or service identity, a target audience, and the smallest useful action. Do not rely on ambient authority.
Contained execution
Run risky work in isolated runtimes with default-deny egress, scrubbed environment variables, and a clear audit trail for every side effect.
A practical assessment surface
Ingress and retrieval
Trace web, email, document, and API inputs into RAG stores and prompt assembly. Record provenance and test poisoned or instruction-shaped content.
MCP and tool execution
Review tool descriptions, argument schemas, authorization scopes, token exchange, and the difference between a requested action and an allowed action.
Edge and application runtime
Harden request signatures, egress destinations, environment exposure, process identity, and error handling before a model can reach infrastructure.
Evaluation and evidence
Turn adversarial prompts and tool misuse cases into repeatable tests. Keep findings close to code, configuration, and the boundary they exercise.
What the research produces
The output is a source-backed research package, not a fear document.
- Trust-boundary maps and threat models
- Tool schema and authorization reviews
- Adversarial test cases with reproducible evidence
- Remediation guidance for application and infrastructure teams
Research direction
Tool calling, explained
Why natural-language output becomes operational control once an agent can invoke functions.
Read the note ↗Cognitive asymmetry
The divide in the agent era is epistemic bandwidth — building abstractions and querying reasoning engines, not hardware access.
Read the note ↗Building an AI butler
A systems view of agent architecture, delegation, and the boundaries that keep autonomy useful.
Read the note ↗The agent-friendly site
How to publish technical context that humans and AI systems can inspect without guesswork.
Read the note ↗Systems security, applied
Autonomy is useful only when its boundaries are testable.
This page is active research and architecture. The methods are published as source-backed research rather than packaged as unverified service promises.
Start a technical conversation