The Prompt Is Not a Perimeter

Telling an agent what it should not do is different from making the prohibited action impossible.

Scenario

A school uses an AI agent to summarize documents. The requirement is: Never send private student data outside the school.

Activity

Classify each proposed control as an instruction, preventive control, approval control, or evidence/detection control:

• A system prompt that says not to send private data.
• A credential that can read only one approved folder.
• An outbound network allowlist.
• A tool allowlist.
• Human approval before an external write.
• Structured output that rejects unexpected fields.
• Audit logs of tool and network activity.
• A short-lived task-specific credential.

Then answer: Which controls actually reduce what the agent is capable of doing?

Six-outcome check

Map the same scenario to the Agent Baseline draft:

1. Discover: List the agent’s owner, purpose, model, tools, data, credentials, and effective access.
2. Constrain: Name one filesystem, network, tool, data, compute, or time boundary.
3. Authorize: Define a consequential action that requires short-lived, task-specific authority.
4. Observe: Choose a run ID and list the events that must be correlated under it.
5. Validate: Describe one prompt-injection test against the configuration the agent will actually use.
6. Respond: Specify how to stop the run, revoke authority, preserve evidence, scope affected records, and continue essential work safely.

Deliverable

Draw a simple boundary diagram showing the model, tools, credentials, filesystem/data source, network, approval point, and logs. Add a six-row table with one concrete control or response for each Agent Baseline outcome.

Discussion

Why can a prompt still be useful even though it is not an access-control boundary? Which of the six outcomes would expose a control that exists only on paper?

Safety

Use a fictional school, synthetic records, and dummy credentials. Do not test prompt injection against production systems, real student data, or services you do not own and have permission to test.

Source material

First spotted in PTIR: August 6, 2026, Morning Briefing.

Cloudflare’s Agent Access Model proposes task-bound, short-lived credentials; enforcement in the agent harness and network instead of prompts; selective approval for consequential actions; evidence-backed grant review; and a one-way reduction of capabilities as sensitive data enters the workflow. The lab turns those architecture ideas into a simple classification exercise about which controls express intent and which actually bound capability.

Consult Cloudflare’s Agent Access Model

Follow-up source added from PTIR: August 12, 2026, Evening Briefing.

Docker, Snyk, and Keycard’s Agent Baseline v1.0 draft organizes 35 controls into six outcomes—Discover, Constrain, Authorize, Observe, Validate, and Respond. Its support-ticket prompt-injection scenario adds a practical lifecycle and incident-response pass to the original boundary exercise. The draft is open for community review through September 30, 2026.

Consult the official Agent Baseline overview