Model the authority chain
Trace the initiating user or event through each agent, credential, tool, API, data store, approval gate, and external effect. Record where authority originates, how it is delegated, and how it can be revoked.
Treat every input as a trust decision
- System instructions, user prompts, retrieved content, memory, tool descriptions, and external messages have different trust levels.
- Untrusted content must not silently change authority, data destinations, tool access, or persistent state.
- High-consequence actions need narrow permissions, deterministic controls, strong observation, and safe recovery.
Test consequential paths
Exercise malformed tool calls, identity changes, hostile retrieved instructions, stale memory, partial failure, repeated actions, unavailable approvers, and provider inconsistency against the real architecture.
This guide provides general security information. It is not a certification, legal opinion, compliance determination, or guarantee of security.