Cheat sheet

Agent security

From lesson 0020. The prompt is not the wall. The harness is.

1. AllowTools the loop may run. Guard mutations.
2. DistrustTicket, RAG, tool output: same tokens as the Guide.
3. KeepSecrets in env. Never in the crate or the window.

Not

• Not a system-prompt firewall. OWASP LLM01: one window.
• Not a jailbreak catalogue. Cap blast radius; do not collect payloads. Harness card.
• Not a crate of live keys. Names only. Plugins card.
• Not “click Approve” as the floor. Anthropic: approval fatigues; contain what the agent can reach.

Simon Willison: assume untrusted text can subvert instructions; limit the tools those instructions can fire. Regression: untrusted ticket cannot mint a refund. Eval suites.