Security Lives Outside the Prompt
The model can recommend a safe action. Only deterministic controls can make an unsafe action impossible. Threat-model direct and indirect prompt injection across trust boundaries. Protect secrets, identities, tenant data, and authorization state. Apply least privilege to tools, filesystems, networks, and MCP servers. Use hooks and policy gates without mistaking them for complete isolation. Redact logs while retaining enough evidence for incident response. Test security controls with adversarial fixtures and fail-closed behavior. A code-review agent reads a pull request description: The content is relevant to the task because it appears in the pull request. It is not trusted instruction. If the agent can read .env, the application has already exposed too much capability. If it can send arbitrary network requests, one malicious document can turn reading into exfiltration. Prompt injection is not only a prompting problem. It is a confused-deputy problem. Untrusted content attempts to use an authorized agent's tools and identity for an unauthorized goal. The strongest fix is not a longer warning. Remove unnecessary authority. Before writing a system prompt, list the actors, data, capabilities, and boundaries. Trusted policy belongs above model output and untrusted content. Secrets belong in trusted integration code. The model receives results, not raw credentials. A tool proposal crosses a policy gate before execution. The tool runs inside a smaller operating-system and network boundary.…
Security Lives Outside the Prompt: The model can recommend a safe action. Only deterministic controls can make an unsafe action impossible.
This free lesson is part of the AI Engineering from Scratch curriculum. Read the full explanation, run the lesson code, and verify the result in the interactive reader or from the repository source.
Browse the complete course catalog or open this lesson on GitHub.