You spend a morning hardening the instructions. Never print a credential. Never echo the token into a summary. Never write it to a file. The agent then works all afternoon — clones a private repository, opens a pull request, answers a review comment — and that evening you go through the transcript looking for the near miss you are sure is in there. Every outgoing request carries the same obvious fake string where the token should be. The rule you spent the morning writing was never tested, because the thing it protects never reached the agent at all.

Nothing leaves the building already stamped

Think of the mail room in an old company building. You write the letter at your desk, seal it, drop it in the tray, and you do not put postage on it. You could not if you wanted to. The franking meter lives downstairs, it is licensed to the building rather than to anyone in it, and the account it draws on has a number nobody upstairs has ever seen. Mail goes out correctly stamped all day, and nobody who writes letters ever holds the thing that stamps them.

A credential broker is that mail room. The agent sends its request with a placeholder where the authorization header belongs, or with no header at all. A proxy on the way out — the agent’s outbound traffic is pointed at it, so there is no other way out — matches the request against rules for that service and that endpoint, swaps the placeholder for the real token it keeps in a vault, and forwards it. A call to GitHub leaves carrying a personal access token the agent never had, cannot repeat, and cannot leak in a summary. The same room keeps the record of what went out under whose authority, and refuses addresses that are not on its list.

A notice above the tray stops nothing

Now look at what a notice can do, and what it cannot. You can pin one above the tray — confidential material is not to be posted externally — and it will help. Most people read it and comply, and it makes the occasional argument shorter. What it never does is stop a letter.

Everything you say to the model is that notice. The system prompt, the instructions inside a skill, the description on a tool, the small flag in a tool definition saying this one only reads and that one is not destructive: all of it is descriptive. It is genuinely useful. A hint is what lets a harness decide to ask you before running something, or to retry one failure and not another, and a legible tool is worth the effort of writing. It is still not a mechanism. A server can be misconfigured. A server can be wrong about itself. And the words in a prompt bend under a page the agent read somewhere.

So the rule is blunt. If your safety depends on something not happening, the control has to hold when the description is wrong. A server may declare a tool non-destructive; what makes that true is the filesystem policy refusing deletions outside one authorized directory. A defence against exfiltration built on a boolean in a tool definition is not a defence at all, because nothing in it restricts where anything can go.

What crosses the counter is a copy

Incoming post is opened in the same room, and it works the same way. What reaches your desk is a copy prepared under rules that travel with the document rather than with whoever is reading it, and the parts your job does not need are not on the page to be read in the first place. Do the same to tool results. A presenter applies the schema, an allowlist of fields, and redaction, in memory, before anything is serialised for the model: the patient record stays whole for the interface that needs it, while the version the agent receives carries no social security number and no diagnosis.

The last piece is who has keys to what. A messenger sent to one floor carries the key to that floor and no other, and a server should come up holding one project directory, or the two repositories the task names, and not the whole disk. Least privilege belongs in the layer that turns an intention into an operation, which is exactly the layer the model does not control.

Everything you tell the model is a suggestion. Build the part that is not.