Two of your agents read the same document this morning and both of them fell for it. The first was running with the repository mounted read only, no credentials of its own, and every outbound call leaving through a proxy that holds the tokens. It tried to send a config directory to an address it found in the text, and the request died at the edge of the machine. The second had a browser, a shell, and the same key your deploy job uses. It succeeded. Same model, same paragraph, same afternoon. What separated them had been decided weeks earlier, by somebody drawing boundaries.

The river will rise either way

Towns on low ground stopped arguing about whether the river comes over. It does. So the design question moved: not how to keep the river out of the valley, but where it is allowed to go once it is in. An embankment along the built side. A field downstream that is meant to flood and holds nothing anyone minds losing. The substation up on a raised plinth, because that is the thing whose loss turns a wet week into a bad year. None of it stops rain, and none of it was built by someone who thought it would.

An agent is a town that has to let the river in. It cannot do the work without reading the vendor’s PDF, the support ticket, the search result, the file it was pointed at. That inflow is the job, which is what makes this different from a model being talked into saying something rude: you cannot decline the inflow and stay useful. And the damage is never the flood on its own. It takes three things arriving together — something worth taking within reach, untrusted content in the context, and a tool that can talk to the outside world. Any two of the three is a wet field.

Earthworks hold when the forecast is wrong

A classifier reading incoming text is a forecast. So is a person clicking approve on the fortieth prompt of the morning, and so is a model asked to notice that it is being played. Forecasts are worth having and they are all probabilistic, which is why the first line is the one that does not predict anything. Isolation strength tracks how much oversight the situation actually gets: a throwaway container for a chat someone is watching, an operating-system boundary for a developer’s workspace, a sealed virtual machine for long work nobody reads until it finishes.

The details are where this is won or lost. Mounts get explicit modes, and symbolic links are resolved before the path is checked, not after. Credentials stay outside the guest entirely, so what the agent holds is a session token that is scoped and can be revoked while the run is still going. And a domain on your allowlist is a capability grant, not a safe destination: a poisoned file that gets an agent to upload documents to an approved API, using a key embedded in the file itself, has walked out through a door you left open on purpose. Privilege works the same way. Effective authority should fall to the least trusted thing already read, which means no administrative token for a task that only reads, and no elevation after untrusted content is in the window.

A tool’s answer is inflow too

Whatever a tool returns lands in the context and shapes the next call, so a service you trust relaying text an attacker wrote is the ordinary case rather than the exotic one. Screening it works in stages: a cheap pass redacts known patterns, a scored pass raises or lowers risk, and a slow classifier is spent only on the band that is genuinely uncertain. Two fields come back and they are not interchangeable. One says allowed and decides; the other is a risk level and belongs in the log. Teams routinely block on the risk level, then find the threshold means something different after a model upgrade. Worse is a timeout that fails open on a tool with real consequences.

The rest is bookkeeping about where things came from. Text marked untrusted is not permitted to be the reason a payment goes out, and a proposed call gets checked against what the user actually asked for before it fires. None of that requires the model to recognise the trick, which is the point, because it will not always. Neither does putting the work inside a boundary it cannot argue with.

The document will get through. What you get to design is how far the water reaches when it does.