Skip to content
Jordan Hudgens
A white capsule robot inside a glass enclosure pushes an envelope through a gold frame into a tray.
Guide 03AdvancedSecurity and containmentAgents and tool usePlaceholder

Contain Agent Actions: Permissions, Prompt Injection, and Human Approval

Enforce boundaries in the environment, not the prompt, and test them with adversarial content.

Start reading
Reading
38 min
Workshop
90 min
Stack
TS · Node 22
Version
1.0.0
Sample values

01Outcomes

Sample

What you will build and be able to do

Each outcome has an observable criterion. The lab and the assessment check exactly these, nothing more and nothing less.

  1. OBJ-001

    Identify the trust boundaries

    Your threat model lists what the agent reads, what it can change, and which inputs you do not control.

  2. OBJ-002

    Constrain reach and change

    Tool permissions, credentials, and network access each limit the agent to what the task needs.

  3. OBJ-003

    Test with adversarial content

    Your boundary tests include harmless adversarial instructions placed inside retrieved content.

  4. OBJ-004

    Verify controls outside the prompt

    A separate check confirms that approval and stop controls work even when the prompt is ignored.

02Prerequisites and setup

Sample

Before you start

  • Guide 01 or an equivalent starter agent
  • Guide 02 for the regression-test structure
  • Node 22 and pnpm installed

03Lesson

Sample

Boundaries belong to the environment

A model follows instructions with some probability. A permission check in your own code either allows an action or does not. Put the boundary where it holds every time, and treat the prompt as guidance rather than enforcement.

Defense in depth

Combine narrow tool permissions, restricted credentials, limited network access, and an approval step that your code checks separately from the model. Each layer fails differently, so a gap in one does not open the whole system.

04Hands-on lab

Sample

Lab 1: Prompt rule against enforced boundary

Place harmless adversarial instructions inside synthetic retrieved content. Compare a prompt-only rule with enforced tool permissions, restricted credentials, limited network access, and a separately checked approval boundary.

Acceptance checks

  • A threat model names every trust boundary
  • Allow and deny cases run as tests
  • The approval check runs outside the prompt
  • A written statement names the residual risk
  1. Show the solution discussion

    Compare which of your deny cases passed with only the prompt rule and which needed the enforced boundary.

05Failure gallery

Sample

Three ways this breaks, and how you will know

Every failure here is reproducible in the lab with a flag. Learn the symptom first; it is what you will actually see.

  • F-01Sample failure

    A rule the content overrides

    Symptom
    The agent follows an instruction it found inside retrieved text.
    Diagnosis
    The only barrier was a sentence in the prompt, and the content argued against it.
    Fix
    Enforce the boundary in tool permissions so the action is unavailable.
    Verify
    The denied action fails in a boundary test with the adversarial text present.
  • F-02Sample failure

    Credentials wider than the task

    Symptom
    A read-only task can still change records.
    Diagnosis
    The agent holds a credential with more reach than the task needs.
    Fix
    Issue a restricted credential for each task and revoke it afterward.
    Verify
    A write attempt with the task credential is rejected.
  • F-03Sample failure

    An approval the agent can skip

    Symptom
    A consequential action runs without a human decision.
    Diagnosis
    The approval step lived in the prompt, so the model could proceed without it.
    Fix
    Check approval in code before the write, separately from the model.
    Verify
    The write is refused until the approval record exists.

06Sources and verification

Sample
  1. [1]How we contain Claude across products · anthropic.comchecked Oct 12, 2026
  2. [2]Our framework for developing safe and trustworthy agents · anthropic.comchecked Oct 12, 2026
  3. [3]Mitigating prompt injections in browser use · anthropic.comchecked Oct 12, 2026

Independent work. Not affiliated with or endorsed by any vendor named in this guide.

Jordan Hudgens

Author

Jordan Hudgens

Technical educator and AI engineering leader. 16 Udemy courses, 111K students, and curricula used by 250K+ learners.

Contact Jordan

Next in the path

All guides