Schema controls, prompt-injection defense, least privilege, circuit breakers, budgets, approvals, and incident response.
For a small example, untrusted text tells an agent to send a secret. Treat content as data, check the requested capability against policy, redact secrets, and deny the outbound action.
The agent reads tickets and can issue credits. Map prompt injection, data exfiltration, excessive agency, and confused-deputy paths; then add least privilege and approval.
Initializing Interactive Playground...
Predict how one control changes the Agent Guardrails & Security result.
The starter deliberately follows a tempting but flawed assumption: Relying on a stronger system prompt
Check: The browser checks pass and you can name the failure mechanism before opening the explanation.
Failing starter lab
Permit only tools in the allow-list and deny side-effecting names by default.
Run the incomplete starter before opening hints. Use the first wrong output or failed check to form a repair hypothesis.
Explanations after each answer · 80% to pass · Agent Guardrails & Security
Chapter 1 of 4 · Core
An agent crosses several trust boundaries: user input, retrieved documents, web pages, tool results, memory, model output, and external side effects. Any text channel can carry adversarial instructions. Prompt injection is therefore a confused-deputy problem, not merely a bad phrase that one perfect system prompt can block.
List protected assets, attacker capabilities, entry points, privileged actions, and failure impact. Separate instruction sources from data sources in the application architecture. The model may interpret both, but policy code should know which channel is authoritative.
Security controls should be layered: input and content scanning, context minimization, tool allowlists, authorization, schema validation, sandboxing, approvals, output checks, monitoring, and incident response. No single classifier is a complete defense.
Two free references selected for Agent Guardrails & Security.
Primary sources and free technical reading for Agent Guardrails & Security.
A practical threat catalog covering prompt injection, insecure output handling, agency, and data exposure.
A public knowledge base of adversarial tactics and techniques against AI-enabled systems.
Research demonstrating indirect prompt injection across tool-integrated systems.
Risk-management guidance tailored to generative AI systems and their lifecycle.