least privilege

An agent that performs actions is far riskier than one that only talks. The signal is action-level guardrails: least privilege, argument validation, human approval for irreversible actions, and a blast-radius mindset. Here is the answer.

Any content an agent reads can smuggle in instructions that hijack it. The signal is knowing why filtering can't fully solve injection and which containment controls actually bound the damage when it succeeds.

There is no one-shot patch for prompt injection, and answering 'sanitize the input' loses the round. What lands is defense in depth: privilege boundaries, handling retrieved content as data rather than instructions, and a human gate on irreversible actions. Here is the layered answer.

An agent that trusts its tools and its own memory can be redirected by one poisoned record that resurfaces turns or sessions later. The signal is treating persistent state as an attack surface, not just the live prompt.

An agent running on a single over-privileged service account is a confused deputy waiting to happen. The signal is per-user delegated credentials, token exchange, per-tool scopes, and an audit trail that names the human. Here is the answer.