Prompt Injection Is a Permission Problem, Not Just a Prompt Problem
An AI agent does not become safe simply because its instructions are well written.
Untrusted Text Can Change the Plan
Prompt injection happens when an agent encounters text that tries to redirect its behavior.
That text might appear in:
- A support ticket
- An uploaded document
- A web page
- An email
- A knowledge-base article
The agent may be asked to summarize the content, but the content itself might contain instructions such as “ignore previous rules” or “send this data elsewhere.”
The key mistake is treating every piece of text as equally authoritative.
Data should inform an agent’s reasoning. It should not automatically gain the power to redefine the agent’s permissions.
Permission Must Come From Policy
A safer design separates three things:
- What the user asked for
- What the agent is allowed to do
- What the surrounding data is trying to make the agent do
Consider a support agent asked to summarize customer complaints.
It may be allowed to:
- Read selected support records
- Group recurring issues
- Draft an internal summary
It should not automatically be allowed to:
- Export the full customer database
- Change billing records
- Send external messages
- Reveal sensitive account information
Even if an uploaded ticket tells the agent to perform one of those actions, the instruction should fail the policy check.
Check Actions at Runtime
A permission decision made at the beginning of a task may not be enough.
Agents encounter new tools, data, and instructions as they work. Each meaningful action should be evaluated against the current task and its approved scope.
Useful runtime checks include:
- Is this action necessary for the stated task?
- Is the target system allowed?
- Does the data contain untrusted instructions?
- Is the action within the agent’s time and authority limits?
- Would the outcome create a material business or security risk?
This turns prompt-injection defense into an authorization process rather than a contest between competing prompts.
Sensitive Outcomes Need a Pause
Some actions should not happen automatically, even when they appear technically permitted.
Require deliberate human approval before an agent:
- Changes financial or billing information
- Sends a message outside the organization
- Exports sensitive records
- Makes an irreversible system change
- Acts outside the original task scope
The approval should show what the agent intends to do, which data it will use, and why the action is being requested.
That gives the reviewer something concrete to approve or reject.
The Goal Is Bounded Autonomy
Prompt injection will remain a practical risk wherever agents process untrusted content.
The answer is not to eliminate autonomy. It is to make autonomy bounded:
- Untrusted text can influence analysis, not authority
- Policies define permitted actions
- Runtime checks evaluate each meaningful step
- Humans approve sensitive outcomes
- Audit evidence records the request, decision, approval, and result
An agent is safer when it cannot turn a piece of text into permission.
