Untrusted input

Two kinds of input

You write instructions and tasks. Users, files, and web pages send text the model treats as facts unless you say otherwise.

Treat that second stream as untrusted. A message can ask the agent to ignore your rules, leak a key from context, or run a tool you did not intend.

Hygiene before you run

Never paste API keys, bot tokens, or customer passwords into a prompt or into agents.yaml.

Separate system instructions from user content where your framework allows it.

When a user can type freely, combine guardrails on output with approval on file and shell tools.

Example

# Checklist (no code runs here)
# [ ] Keys only in the environment
# [ ] Dangerous tools need a human yes on an interactive terminal
# [ ] Guardrail functions reject answers that break your rules