Prompt injection defense in depth for tool-using agents addresses one concrete problem: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. The guide works from the actual objects — prompt injection, tool authorization, guardrail, approval, monitoring — and aims for a verifiable decision rather than a generic pattern.
The concrete problem: prompt injection meets tool authorization
The starting point is not a feature; it is an observable decision boundary.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c11 starts at prompt injection and treats tool authorization as an explicit boundary rather than an implicit assumption. The first control requires guardrail to emit an observable result before approval can trigger the intended effect around monitoring. Operations then observes the transition between guardrail and approval, while security checks that monitoring receives neither implicit authority nor unnecessary data. If the approval verification fails, rollback restores the configuration around monitoring, replays prompt-injection-defense-in-depth-agents-c11, and compares the new state with the control evidence from prompt injection. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to tool authorization, a concrete condition, and evidence instead of a generic assurance.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c12 starts at tool authorization and treats guardrail as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before monitoring can trigger the intended effect around prompt injection. The conclusion stays bounded by approval and prompt injection: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c12 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns tool authorization into a reviewable decision point with a named input and a retained output. To test guardrail, fixture prompt-injection-defense-in-depth-agents-c12 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c13 starts at guardrail and treats approval as an explicit boundary rather than an implicit assumption. The first control requires monitoring to emit an observable result before prompt injection can trigger the intended effect around tool authorization. Operations then observes the transition between monitoring and prompt injection, while security checks that tool authorization receives neither implicit authority nor unnecessary data. If the prompt injection verification fails, rollback restores the configuration around tool authorization, replays prompt-injection-defense-in-depth-agents-c13, and compares the new state with the control evidence from guardrail. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c14 starts at approval and treats monitoring as an explicit boundary rather than an implicit assumption. The first control requires prompt injection to emit an observable result before tool authorization can trigger the intended effect around guardrail. The conclusion stays bounded by prompt injection and guardrail: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c14 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns approval into a reviewable decision point with a named input and a retained output. To test monitoring, fixture prompt-injection-defense-in-depth-agents-c14 contains both an allowed state and a rejected state; rejection must occur before any change attributed to prompt injection.
Trust boundaries around guardrail
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c21 starts at tool authorization and treats guardrail as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before monitoring can trigger the intended effect around prompt injection. To test guardrail, fixture prompt-injection-defense-in-depth-agents-c21 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval. Operations then observes the transition between approval and monitoring, while security checks that prompt injection receives neither implicit authority nor unnecessary data. If the monitoring verification fails, rollback restores the configuration around prompt injection, replays prompt-injection-defense-in-depth-agents-c21, and compares the new state with the control evidence from tool authorization.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c22 starts at guardrail and treats approval as an explicit boundary rather than an implicit assumption. The first control requires monitoring to emit an observable result before prompt injection can trigger the intended effect around tool authorization. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by monitoring and tool authorization: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c22 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns guardrail into a reviewable decision point with a named input and a retained output.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c23 starts at approval and treats monitoring as an explicit boundary rather than an implicit assumption. The first control requires prompt injection to emit an observable result before tool authorization can trigger the intended effect around guardrail. To test monitoring, fixture prompt-injection-defense-in-depth-agents-c23 contains both an allowed state and a rejected state; rejection must occur before any change attributed to prompt injection. Operations then observes the transition between prompt injection and tool authorization, while security checks that guardrail receives neither implicit authority nor unnecessary data. If the tool authorization verification fails, rollback restores the configuration around guardrail, replays prompt-injection-defense-in-depth-agents-c23, and compares the new state with the control evidence from approval.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c24 starts at monitoring and treats prompt injection as an explicit boundary rather than an implicit assumption. The first control requires tool authorization to emit an observable result before guardrail can trigger the intended effect around approval. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to prompt injection, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool authorization and approval: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c24 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns monitoring into a reviewable decision point with a named input and a retained output.
Build the decision path with approval
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c31 starts at guardrail and treats approval as an explicit boundary rather than an implicit assumption. The first control requires monitoring to emit an observable result before prompt injection can trigger the intended effect around tool authorization. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns guardrail into a reviewable decision point with a named input and a retained output. To test approval, fixture prompt-injection-defense-in-depth-agents-c31 contains both an allowed state and a rejected state; rejection must occur before any change attributed to monitoring. Operations then observes the transition between monitoring and prompt injection, while security checks that tool authorization receives neither implicit authority nor unnecessary data.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c32 starts at approval and treats monitoring as an explicit boundary rather than an implicit assumption. The first control requires prompt injection to emit an observable result before tool authorization can trigger the intended effect around guardrail. If the tool authorization verification fails, rollback restores the configuration around guardrail, replays prompt-injection-defense-in-depth-agents-c32, and compares the new state with the control evidence from approval. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to monitoring, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by prompt injection and guardrail: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c32 is labeled as a limitation or inference, never promoted to fact.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c33 starts at monitoring and treats prompt injection as an explicit boundary rather than an implicit assumption. The first control requires tool authorization to emit an observable result before guardrail can trigger the intended effect around approval. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns monitoring into a reviewable decision point with a named input and a retained output. To test prompt injection, fixture prompt-injection-defense-in-depth-agents-c33 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool authorization. Operations then observes the transition between tool authorization and guardrail, while security checks that approval receives neither implicit authority nor unnecessary data.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c34 starts at prompt injection and treats tool authorization as an explicit boundary rather than an implicit assumption. The first control requires guardrail to emit an observable result before approval can trigger the intended effect around monitoring. If the approval verification fails, rollback restores the configuration around monitoring, replays prompt-injection-defense-in-depth-agents-c34, and compares the new state with the control evidence from prompt injection. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to tool authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by guardrail and monitoring: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c34 is labeled as a limitation or inference, never promoted to fact.
Verify monitoring with observable evidence
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c41 starts at approval and treats monitoring as an explicit boundary rather than an implicit assumption. The first control requires prompt injection to emit an observable result before tool authorization can trigger the intended effect around guardrail. The conclusion stays bounded by prompt injection and guardrail: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c41 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns approval into a reviewable decision point with a named input and a retained output. To test monitoring, fixture prompt-injection-defense-in-depth-agents-c41 contains both an allowed state and a rejected state; rejection must occur before any change attributed to prompt injection.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c42 starts at monitoring and treats prompt injection as an explicit boundary rather than an implicit assumption. The first control requires tool authorization to emit an observable result before guardrail can trigger the intended effect around approval. Operations then observes the transition between tool authorization and guardrail, while security checks that approval receives neither implicit authority nor unnecessary data. If the guardrail verification fails, rollback restores the configuration around approval, replays prompt-injection-defense-in-depth-agents-c42, and compares the new state with the control evidence from monitoring. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to prompt injection, a concrete condition, and evidence instead of a generic assurance.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c43 starts at prompt injection and treats tool authorization as an explicit boundary rather than an implicit assumption. The first control requires guardrail to emit an observable result before approval can trigger the intended effect around monitoring. The conclusion stays bounded by guardrail and monitoring: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c43 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns prompt injection into a reviewable decision point with a named input and a retained output. To test tool authorization, fixture prompt-injection-defense-in-depth-agents-c43 contains both an allowed state and a rejected state; rejection must occur before any change attributed to guardrail.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c44 starts at tool authorization and treats guardrail as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before monitoring can trigger the intended effect around prompt injection. Operations then observes the transition between approval and monitoring, while security checks that prompt injection receives neither implicit authority nor unnecessary data. If the monitoring verification fails, rollback restores the configuration around prompt injection, replays prompt-injection-defense-in-depth-agents-c44, and compares the new state with the control evidence from tool authorization. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to guardrail, a concrete condition, and evidence instead of a generic assurance.
Failure modes, signals, and diagnosis
The starting point is not a feature; it is an observable decision boundary.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c51 starts at monitoring and treats prompt injection as an explicit boundary rather than an implicit assumption. The first control requires tool authorization to emit an observable result before guardrail can trigger the intended effect around approval. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to prompt injection, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by tool authorization and approval: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c51 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns monitoring into a reviewable decision point with a named input and a retained output.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c52 starts at prompt injection and treats tool authorization as an explicit boundary rather than an implicit assumption. The first control requires guardrail to emit an observable result before approval can trigger the intended effect around monitoring. To test tool authorization, fixture prompt-injection-defense-in-depth-agents-c52 contains both an allowed state and a rejected state; rejection must occur before any change attributed to guardrail. Operations then observes the transition between guardrail and approval, while security checks that monitoring receives neither implicit authority nor unnecessary data. If the approval verification fails, rollback restores the configuration around monitoring, replays prompt-injection-defense-in-depth-agents-c52, and compares the new state with the control evidence from prompt injection.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c53 starts at tool authorization and treats guardrail as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before monitoring can trigger the intended effect around prompt injection. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to guardrail, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by approval and prompt injection: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c53 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns tool authorization into a reviewable decision point with a named input and a retained output.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c54 starts at guardrail and treats approval as an explicit boundary rather than an implicit assumption. The first control requires monitoring to emit an observable result before prompt injection can trigger the intended effect around tool authorization. To test approval, fixture prompt-injection-defense-in-depth-agents-c54 contains both an allowed state and a rejected state; rejection must occur before any change attributed to monitoring. Operations then observes the transition between monitoring and prompt injection, while security checks that tool authorization receives neither implicit authority nor unnecessary data. If the prompt injection verification fails, rollback restores the configuration around tool authorization, replays prompt-injection-defense-in-depth-agents-c54, and compares the new state with the control evidence from guardrail.
Progressive rollout and rollback
A production design should make it clear who decides, what evidence is available, and what can be rolled back.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c61 starts at prompt injection and treats tool authorization as an explicit boundary rather than an implicit assumption. The first control requires guardrail to emit an observable result before approval can trigger the intended effect around monitoring. If the approval verification fails, rollback restores the configuration around monitoring, replays prompt-injection-defense-in-depth-agents-c61, and compares the new state with the control evidence from prompt injection. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to tool authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by guardrail and monitoring: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c61 is labeled as a limitation or inference, never promoted to fact.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c62 starts at tool authorization and treats guardrail as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before monitoring can trigger the intended effect around prompt injection. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns tool authorization into a reviewable decision point with a named input and a retained output. To test guardrail, fixture prompt-injection-defense-in-depth-agents-c62 contains both an allowed state and a rejected state; rejection must occur before any change attributed to approval. Operations then observes the transition between approval and monitoring, while security checks that prompt injection receives neither implicit authority nor unnecessary data.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c63 starts at guardrail and treats approval as an explicit boundary rather than an implicit assumption. The first control requires monitoring to emit an observable result before prompt injection can trigger the intended effect around tool authorization. If the prompt injection verification fails, rollback restores the configuration around tool authorization, replays prompt-injection-defense-in-depth-agents-c63, and compares the new state with the control evidence from guardrail. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to approval, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by monitoring and tool authorization: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c63 is labeled as a limitation or inference, never promoted to fact.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c64 starts at approval and treats monitoring as an explicit boundary rather than an implicit assumption. The first control requires prompt injection to emit an observable result before tool authorization can trigger the intended effect around guardrail. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns approval into a reviewable decision point with a named input and a retained output. To test monitoring, fixture prompt-injection-defense-in-depth-agents-c64 contains both an allowed state and a rejected state; rejection must occur before any change attributed to prompt injection. Operations then observes the transition between prompt injection and tool authorization, while security checks that guardrail receives neither implicit authority nor unnecessary data.
Production decision criteria
The hard part appears when the happy path meets authorization, failures, and operational constraints.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c71 starts at tool authorization and treats guardrail as an explicit boundary rather than an implicit assumption. The first control requires approval to emit an observable result before monitoring can trigger the intended effect around prompt injection. Operations then observes the transition between approval and monitoring, while security checks that prompt injection receives neither implicit authority nor unnecessary data. If the monitoring verification fails, rollback restores the configuration around prompt injection, replays prompt-injection-defense-in-depth-agents-c71, and compares the new state with the control evidence from tool authorization. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to guardrail, a concrete condition, and evidence instead of a generic assurance.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c72 starts at guardrail and treats approval as an explicit boundary rather than an implicit assumption. The first control requires monitoring to emit an observable result before prompt injection can trigger the intended effect around tool authorization. The conclusion stays bounded by monitoring and tool authorization: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c72 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns guardrail into a reviewable decision point with a named input and a retained output. To test approval, fixture prompt-injection-defense-in-depth-agents-c72 contains both an allowed state and a rejected state; rejection must occur before any change attributed to monitoring.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c73 starts at approval and treats monitoring as an explicit boundary rather than an implicit assumption. The first control requires prompt injection to emit an observable result before tool authorization can trigger the intended effect around guardrail. Operations then observes the transition between prompt injection and tool authorization, while security checks that guardrail receives neither implicit authority nor unnecessary data. If the tool authorization verification fails, rollback restores the configuration around guardrail, replays prompt-injection-defense-in-depth-agents-c73, and compares the new state with the control evidence from approval. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to monitoring, a concrete condition, and evidence instead of a generic assurance.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c74 starts at monitoring and treats prompt injection as an explicit boundary rather than an implicit assumption. The first control requires tool authorization to emit an observable result before guardrail can trigger the intended effect around approval. The conclusion stays bounded by tool authorization and approval: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c74 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns monitoring into a reviewable decision point with a named input and a retained output. To test prompt injection, fixture prompt-injection-defense-in-depth-agents-c74 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool authorization.
Evidence point: OpenAI documents that run results expose final output, new items, agent identity, raw responses, guardrail results, state and usage diagnostics. This source anchors production decision criteria but does not replace local verification. [S7]Controls that remain after launch
A robust implementation separates what the model proposes from what the application authorizes and verifies.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c81 starts at guardrail and treats approval as an explicit boundary rather than an implicit assumption. The first control requires monitoring to emit an observable result before prompt injection can trigger the intended effect around tool authorization. To test approval, fixture prompt-injection-defense-in-depth-agents-c81 contains both an allowed state and a rejected state; rejection must occur before any change attributed to monitoring. Operations then observes the transition between monitoring and prompt injection, while security checks that tool authorization receives neither implicit authority nor unnecessary data. If the prompt injection verification fails, rollback restores the configuration around tool authorization, replays prompt-injection-defense-in-depth-agents-c81, and compares the new state with the control evidence from guardrail.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c82 starts at approval and treats monitoring as an explicit boundary rather than an implicit assumption. The first control requires prompt injection to emit an observable result before tool authorization can trigger the intended effect around guardrail. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to monitoring, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by prompt injection and guardrail: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c82 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns approval into a reviewable decision point with a named input and a retained output.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c83 starts at monitoring and treats prompt injection as an explicit boundary rather than an implicit assumption. The first control requires tool authorization to emit an observable result before guardrail can trigger the intended effect around approval. To test prompt injection, fixture prompt-injection-defense-in-depth-agents-c83 contains both an allowed state and a rejected state; rejection must occur before any change attributed to tool authorization. Operations then observes the transition between tool authorization and guardrail, while security checks that approval receives neither implicit authority nor unnecessary data. If the guardrail verification fails, rollback restores the configuration around approval, replays prompt-injection-defense-in-depth-agents-c83, and compares the new state with the control evidence from monitoring.
In “Prompt injection defense in depth for tool-using agents”, scenario prompt-injection-defense-in-depth-agents-c84 starts at prompt injection and treats tool authorization as an explicit boundary rather than an implicit assumption. The first control requires guardrail to emit an observable result before approval can trigger the intended effect around monitoring. This detail makes “Prompt injection defense in depth for tool-using agents” reviewable because each operational statement points to tool authorization, a concrete condition, and evidence instead of a generic assurance. The conclusion stays bounded by guardrail and monitoring: anything not demonstrated by scenario prompt-injection-defense-in-depth-agents-c84 is labeled as a limitation or inference, never promoted to fact. That sequence serves this concrete job: Layer content separation, tool authorization, approvals, output validation and monitoring rather than relying on a single prompt. It turns prompt injection into a reviewable decision point with a named input and a retained output.
Evidence point: Model Context Protocol documents that for HTTP authorization, MCP requires resource-bound tokens, server-side audience validation and PKCE, and forbids insecure token passthrough patterns. This source anchors controls that remain after launch but does not replace local verification. [S8]Operational checklist
- The control around prompt injection has an input, a rule, a rejection behavior, and evidence.
- The control around tool authorization has an input, a rule, a rejection behavior, and evidence.
- The control around guardrail has an input, a rule, a rejection behavior, and evidence.
- The control around approval has an input, a rule, a rejection behavior, and evidence.
- The control around monitoring has an input, a rule, a rejection behavior, and evidence.
Sources and control points
- [S1] Tracing - OpenAI Agents SDK — Tracing records model generations, tool calls, handoffs, guardrails and custom events, and sensitive payload capture can be disabled. source
- [S2] Handoffs - OpenAI Agents SDK — Handoffs transfer the active conversation to a specialist agent and can filter or reshape the history passed to the destination. source
- [S3] Agent orchestration - OpenAI Agents SDK — Two common orchestration patterns are manager-controlled agents-as-tools and handoffs where a specialist becomes the active agent. source
- [S4] Guardrails - OpenAI Agents SDK — Agent and tool guardrails can validate inputs or outputs and can stop execution with tripwire-style failures. source
- [S5] Model context protocol (MCP) - OpenAI Agents SDK — MCP integrations can expose remote or local tools; the documentation recommends trusted servers, least-privilege credentials and approvals for sensitive operations. source
- [S6] Encrypted session - OpenAI Agents SDK — EncryptedSession can wrap a session store with Fernet encryption, per-session HKDF-derived keys and TTL-based expiration. source
- [S7] Results - OpenAI Agents SDK — Run results expose final output, new items, agent identity, raw responses, guardrail results, state and usage diagnostics. source
- [S8] Authorization - Model Context Protocol — For HTTP authorization, MCP requires resource-bound tokens, server-side audience validation and PKCE, and forbids insecure token passthrough patterns. source
- [S9] REST Security Cheat Sheet — OWASP REST guidance emphasizes HTTPS, explicit access control and careful handling of tokens, methods, inputs and security headers. source
- [S10] AI Risk Management Framework — NIST positions the AI RMF as a voluntary framework for managing AI risks and is revising it while adding profiles for specific settings. source
Comments
No published comment yet.
Sign in to comment