PRODUCTION SCENARIO
A scheduling agent reads calendar invites from external senders inside tool_result blocks and can call a refund_order tool. One invite body contains text instructing the model to issue a refund. The system prompt already states that tool results are untrusted data.
Which control prevents the refund even if every screening layer misses the injection?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: An authorization check in the refund handler that the signed-in user asked for it
Least privilege is the enforceable layer: a check inside the refund handler that the signed-in user actually requested the refund holds no matter what the model was persuaded to call, because it runs in application code rather than in the prompt. A stronger system-prompt rule restates a policy the prompt already carries and is still advisory. A Haiku screen lowers the odds but is a classifier that can miss. And JSON encoding removes the ambiguity about where the untrusted string ends without stopping a model that decides to act on a clearly delimited instruction.