AI security · Field notes
The prompt is not the permission slip.
Why an agent reading a webpage should not inherit that page’s ambitions—and how to put the boundary in code.
Kinwilder research desk · · AI-assisted analysis
Code specimen
Kinwilder illustration · narrow authorization check
function authorizeSend(action: Send, task: Capability) {
if (action.to !== task.allowedRecipient) return false;
if (action.documentId !== task.documentId) return false;
return task.permissions.includes("send");
}- Line 1: Trust comes from outside — task must be a trusted, application-issued capability; a model or document cannot mint it.
- Line 2: Pin the effect — Match the final destination, not just the general tool name.
- Line 4: Necessary, not sufficient — A production executor also needs identity, expiration, canonicalization, replay protection and audit records.
An assistant reads an invoice and decides to send an email. Which part of the system decided it was allowed to send? If the answer is “the same model that read the invoice,” untrusted content is sitting very close to authority.
Anthropic's November 2025 browser-security research describes indirect prompt injection through material an agent encounters, including web content and email. It reports improvements from training and surrounding safeguards while explicitly warning that browser agents remain vulnerable. We use that publication as an architectural case study, not as a claim about the performance of today's models. Anthropic research.
The useful distinction
Our analysis separates understanding a request from authorizing an action. A webpage may contain instructions relevant to the user's task, such as how to fill out a public form. That does not grant it the right to choose an email recipient, access another account, or expand the task's scope.
A practical agent can propose an action as structured data. A separate policy layer checks the proposal against permissions established from the user's request. The policy should not accept a field like approved: true merely because the model supplied it. It should use a trusted task record and compare the exact action, destination, resource, and relevant limits.
What the example does
Our TypeScript specimen sketches a narrow policy check for sending a document to a preapproved destination. Both the recipient and document ID must match the trusted task capability. The capability must be minted by the application, not parsed from the page being summarized. This sketch is incomplete by design: a production system also needs identity, expiry, replay protection, canonicalization, atomic enforcement, and audit trails.
The reason for showing a small check is conceptual. It makes an unauthorized choice fail outside the language model. Better model judgment is useful; the application still owns the decision about which effects are possible.
Threat model the entire round trip
Start with the data the agent can read. Then list the tools it can call and the destinations those tools can reach. Finally, identify which tool arguments originate in untrusted content. The riskiest crossings often connect two individually ordinary permissions: read an internal document, send an external message.
Keep research agents separate from administrative sessions. Give a summarizer a read-only interface when that is all the task needs. Enforce network destinations and filesystem access at the executor. Validate the actual action immediately before execution, including redirects and final recipients. Log decisions without logging confidential document bodies.
A test worth running
In an isolated test account, place a harmless canary instruction in a document and ask the agent to summarize it. The desired observation is not only that the model ignores it. Verify that the executor would reject an out-of-scope action even if the model proposed one. Keep the canary destination under your control and use synthetic data.
A blocked tool call is a stronger boundary test than a polite refusal in a chat transcript. Neither proves immunity to every attack. Together, model behavior tests and enforced capabilities give you something concrete to maintain as agents gain new abilities.