{
 "license": "CC-BY-4.0",
 "attribution": "Fide AI, Agentic Cyber Explorer",
 "url": "https://agentic-cyber-explorer.pages.dev/findings/constrain-what-untrusted-input-can-trigger/",
 "asOf": "2026-09-26",
 "id": "constrain-what-untrusted-input-can-trigger",
 "claim": "Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.",
 "evidenceKind": "argued",
 "scope": "A design position that several parties converge on. It trades away capability and is not a measurement.",
 "topics": [
  "prompt-injection",
  "data-exfiltration"
 ],
 "atlas": [
  "untrusted-content",
  "tools",
  "credentials"
 ],
 "evidence": [
  {
   "event": "design-patterns-securing-agents-prompt-injection-2025"
  },
  {
   "event": "willison-lethal-trifecta-2025"
  },
  {
   "event": "meta-agents-rule-of-two-2025"
  },
  {
   "event": "openai-safe-url-exfiltration-defense-2026"
  },
  {
   "event": "openai-lockdown-mode-elevated-risk-2026"
  }
 ],
 "relations": [
  {
   "type": "supports",
   "target": "architectural-isolation-bounds-injection",
   "note": "CaMeL is one implementation of this principle."
  }
 ],
 "statusHistory": [
  {
   "status": "reported",
   "on": "2025-06-10",
   "why": "Design patterns paper argues for constraining agents.",
   "event": "design-patterns-securing-agents-prompt-injection-2025",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2025-06-16",
   "why": "Independent framing of the same principle as the lethal trifecta.",
   "event": "willison-lethal-trifecta-2025",
   "kind": "evidence"
  },
  {
   "status": "corroborated",
   "on": "2026-09-25",
   "why": "Correction: Willison's post quotes and builds on the design patterns paper, so it is not independent of it. Corroboration rests on separate organizations adopting the position, such as OpenAI's deterministic Lockdown Mode.",
   "event": "openai-lockdown-mode-elevated-risk-2026",
   "kind": "correction"
  }
 ],
 "halfLifeDays": 730,
 "wouldChange": "A deployed system where architectural constraints were bypassed without a model failure.",
 "fideQuestions": [
  "FID-074"
 ],
 "methods": [
  "agent-data-exfiltration",
  "capability-restriction",
  "control-data-isolation",
  "indirect-prompt-injection"
 ],
 "review": "assistant-drafted",
 "addedOn": "2026-09-25"
}