Untrusted Content and Tool Separation
Treat external content as data, keep instructions and data separate, and restrict tool use when an AI component processes untrusted input.
AITrust boundary
Open pack page →The safeguard library
See the safeguards before you use them.
Reusable rules for the decisions you make, the safeguards your agent builds, and the evidence you keep.
You decideSet the boundary
Your agent buildsEnforce the rule
Keep evidenceReview what was built
Want to see a pack in action? Every Control Pack has a worked example you can inspect: browse the published examples.
The big picture
Where things can go wrong
Most AI-assisted systems follow these steps. Each box is a category of safeguards and how many packs cover that step. Choose one to see those packs.
- 1 · Starts hereA request or outside content arrives4 packs
- 2 · Decided hereThe AI or app decides what to do3 packs
- 3 · Acts hereThe change is made12 packs
- 4 · Checked afterThe result is recorded and watched7 packs
Underneath every stepStored data and records8 packs
The same colour is the same category wherever it appears. This is a typical system, not yours: a review of your own build keeps only the packs that apply.
Search is temporarily unavailable. You can still open the published pack pages below.
AI systems
4 packs
Model Output Validation
Treat model output as untrusted data until it passes schema, policy, and consequence-aware validation.
AIValidationTrust boundary
Open pack page →High-Consequence Model Review
Keep high-consequence model suggestions visibly provisional until an authorized person confirms the action boundary.
AIHuman controlAuthority
Open pack page →Grounded Model Output and Instruction Separation
Decide what a model's output is allowed to be used for before it is used, keep retrieved or user-supplied content separated from the instructions that carry authority, and make a low-confidence or unavailable answer a defined outcome rather than a silent one.
AI
Open pack page →Automation
5 packs
Bounded Autonomous Action
Define scope, thresholds, escalation, idempotency, and an emergency disable path before automation can perform consequential actions.
AutomationAuthority
Open pack page →Bounded Irreversible and Bulk Action
Preview, bound, and recover from destructive or irreversible automated actions before they are released.
AutomationRecoveryChange safety
Open pack page →Cost and Quota Boundary
Make expensive, high-volume, or quota-consuming automation bounded and observable.
AutomationCostReliability
Open pack page →Automated Work Completeness and Accuracy
Decide what a complete and correct automated run looks like before relying on one, so a run that skipped, duplicated, or mishandled work is distinguishable from a run that did the job.
AutomationReliability
Open pack page →Work That Should Have Happened
Say when automated work is expected, and raise a signal when it does not happen -- because a job that stops running produces no error to notice.
AutomationReliabilityObservability
Open pack page →Input and files
2 packs
Untrusted Input Handling
Validate, bound, and safely render content that people outside the system control, and keep it from reaching an interpreter, a privileged path, or another user unchecked.
DataAutomation
Open pack page →Uploaded File and Document Handling
Decide which file types and sizes you accept, store them under a name and location the uploader does not control, and never serve or open one in a way that lets its content or name reach somewhere it should not.
DataAutomation
Open pack page →Identity and access
5 packs
Least Authority for Automated Tools
Constrain automated tool calls to the minimum resources, operations, and approval scope required by the confirmed design.
IdentityAuthority
Open pack page →Temporary Privilege Expiry
Make privileged authority time-bound, purpose-bound, and independently visible when it crosses a dependency boundary.
IdentityAuthorityRecovery
Open pack page →Tenant-Scoped Authority
Keep automated authority inside an explicit tenant, workspace, or organization boundary.
IdentityMulti tenancyAuthority
Open pack page →Access Rights and Authorization Boundary
State who may perform which operations, enforce it where the action happens rather than only in the interface, remove access deliberately rather than by habit, and record every change to who holds what.
IdentityObservability
Open pack page →Account Identity and Session Boundary
Establish who a request is from where the work happens, decide how long a session lasts and how it ends, and make sure one account's identifier cannot be substituted for another's.
Identity
Open pack page →Data
7 packs
Sensitive Data Boundary
Keep sensitive data within an explicit boundary with purpose limitation, access control, retention, deletion, and controlled export.
DataPrivacy
Open pack page →Controlled Data Export
Make export destinations, fields, approvals, and audit records explicit before data leaves its current boundary.
DataPrivacyExport
Open pack page →Tenant Data Isolation
Define storage, query, cache, and operational boundaries that prevent one tenant's data from appearing in another tenant's context.
DataPrivacyMulti tenancy
Open pack page →Retention and Deletion Boundary
Require an explicit retention purpose, deletion trigger, and verification path for sensitive data and irreversible deletion.
DataPrivacyRecovery
Open pack page →Record Accuracy and Correction
Decide how a wrong record about a person or an organization gets found and fixed, and make sure a correction reaches every copy that decisions are read from.
Data
Open pack page →Protected Transit Between Components
Name the hops that carry data worth protecting, state what protects each one, verify the far end is the intended one, and refuse an unprotected fallback.
DataChange
Open pack page →Stored Data and Key Boundary
Name every store and copy that holds the data, state what protects each one at rest, and confirm who holds the key, what it opens, and how it is replaced.
DataPrivacyRecovery
Open pack page →Reliability
4 packs
External Dependency Partial Failure
Define timeout, retry, reconciliation, degraded-mode, and rollback behavior when an external dependency is unavailable or ambiguous.
ReliabilityRecovery
Open pack page →Irreversible Dependency Reconciliation
Reconcile ambiguous external results before retrying an irreversible operation.
ReliabilityRecoveryExternal dependency
Open pack page →Dependency Rate and Load Protection
Protect a metered or fragile dependency from unbounded concurrency, retry amplification, and quota exhaustion.
ReliabilityCostExternal dependency
Open pack page →Data Durability and Tested Restore
Decide how much data loss and downtime is acceptable, then show that a restore has actually been performed rather than assumed from the existence of a backup.
ReliabilityData
Open pack page →Production change
3 packs
Protected Production Change
Make production changes reviewable, bounded, reversible where possible, and observable before automation can apply them.
Change safetyProductionAuthority
Open pack page →Deployment Rollback and Recovery
Define how a production deployment detects failure, stops safely, rolls back, and reconciles state.
Change safetyReliabilityRecovery
Open pack page →Runtime Configuration and Feature Switches
Name the switches that change what production does, say who may change each one and what it currently controls, and keep a record of every change and the way back.
Change safetyProductionAuthority
Open pack page →Observability
4 packs
Traceable Consequential Actions
Make consequential automated decisions observable without collecting raw prompts, secrets, or unnecessary sensitive content.
ObservabilityAudit
Open pack page →Administrative Change Visibility
Make privileged production changes attributable, reviewable, and distinguishable from automated routine activity.
ObservabilityAuditProduction
Open pack page →Failure Visibility and Escalation
Decide which failures a person must be told about, who is told, and how fast — so a broken job, a backed-up queue, or a degraded dependency is not discovered by a customer first.
ObservabilityReliability
Open pack page →Records That Survive and Can Be Relied On
Decide how long the record has to answer questions, keep it where losing the system does not lose the record, and stop the account that acted from editing its own trail.
ObservabilityAuditRecovery
Open pack page →How these safeguards work
The review, API, agent tools, and download use the same versioned pack rules. All current packs are still in review. They provide design guidance; they do not certify your project or prove its safeguards work.