An agent’s prompt is not an authority system

An agent declaration may explain which tools an agent is intended to use. A system prompt may tell the model to refuse unsafe requests. Neither mechanism can be the final authority for a consequential action, because both are inputs to the same probabilistic system that processes untrusted content.

The architecture needs a boundary the model cannot rewrite.

The hard rule#

An action is never taken until deterministic policy says it may. The decision record exists before the effect.

This rule separates five things that a chat interface tends to collapse:

what information may be retrieved;
what the model may propose;
which tools the runtime identity may reach;
what policy and approval authorise now; and
which bounded effect is executed.

Retrieval has authority#

Structured data, graph relationships and prose do not carry the same kind of authority. A governed semantic measure may own a business number. A policy document may own the current rule. A previous version of that document may be relevant evidence but must not remain eligible as the current answer.

Each knowledge corpus therefore declares the topics it is authoritative for. Supersession removes an obsolete corpus from normal retrieval eligibility. A vector similarity score cannot decide which policy is current.

Retrieved material remains data. Instructions embedded in a document cannot expand the tools, grants or policies available to the agent.

Effective authority is an intersection#

An agent declaration states its maximum intended capability. At runtime, the effective grant is narrowed by:

the workload or user identity;
the current data and tool policies;
the exact action and arguments proposed;
required human approval; and
expiry, environment and idempotency constraints.

No element can widen the others. A broad tool declared in source cannot bypass a narrower runtime identity. An approver cannot authorise a substituted set of arguments. An expired approval cannot be replayed as current authority.

Decision before action#

The durable record should connect:

agent declaration and version;
model and prompt version;
retrieved context identities;
proposed tool and typed arguments;
policy inputs and verdict;
approval identity, scope and expiry where required; and
the resulting effect identity and outcome.

Writing this after execution creates a log, not a control. The decision record must exist first so the effect can reference the authority that permitted it.

Failure behaviour matters most#

The action gate fails closed when policy, identity or approval cannot be resolved. Retries use an idempotency key tied to the accepted decision. A partially completed effect follows a tool-specific recovery path rather than asking the model to improvise compensation.

Memory is handled separately. Conversation history may improve continuity, but it does not become a new source of authority and it remains subject to purpose, retention and data-access rules.

Evidence to request#

Superseded knowledge cannot appear as the current authoritative result.
Retrieved text cannot add a tool or expand a grant.
Missing policy or approval fails closed.
Approval expiry and argument substitution are rejected.
The decision record is durable before the tool invocation.
Retried execution produces one bounded effect.
Adversarial evaluation covers prompt injection and malicious tool output.

Limitation#

Prompt injection cannot be eliminated by better instruction text. The control objective is containment: untrusted content stays data, authority remains outside the model, and the maximum consequence is bounded by deterministic policy and isolation.

Questions

Can a read-only agent skip the action gate?

It may not need an effect approval, but it still needs governed retrieval, scoped identity, output handling and audit. Read-only access is an authority boundary, not the absence of one.

Does human approval make any proposed action safe?

No. Approval should be scoped to the exact action, arguments, identity and expiry after deterministic policy has already accepted the proposal.