AI Agent Evidence Must Stay Bound to Its Source

Use one evidence model

Every pattern on this page tests the same rule. Data may describe a decision. It may not grant itself more authority.

A safe verdict for one image does not clear a later image. A low confidence transcript does not become a command when a summary hides it. A duplicate policy field does not become valid because one parser picked the permissive value. A watermark does not prove the current model is the model that earned trust. A review field that says clean does not prove that a review ran.

These failures survive clean syntax. The JSON may parse. The badge may look official. The result may rank first. The object may satisfy a schema. The agent can still act on evidence that belongs to another source, another scope or another point in time.

Use six fields for every consequential decision.

1. Source. Record who or what produced the evidence.
2. Subject. Name the exact image, record, model, task or component that the evidence describes.
3. Scope. Keep the tenant, audience, policy and allowed operation attached.
4. Transform. Record each parser, decoder, summary, reducer and cache step.
5. Freshness. Check the current version, state and revocation facts.
6. Sink. Decide again at the final send, write, execute, publish or update boundary.

The final check must use trusted code. A model can explain the evidence. It cannot certify its own input or approve its own action.

Bind audio and images to current checks

Multimodal evidence stays safe only when the system preserves which media object produced it and what changed before action.

GLS-IP-003 covers a low confidence ASR segment that carries an action verb behind a benign audible summary. The danger appears when transcription strips confidence or source identity. The downstream router then sees text without the uncertainty that limited it.

Keep each transcript segment bound to the audio source, time range, confidence score and visible user summary. Show the exact action bearing text before a send, upload, purchase or delete. Require fresh confirmation through a trusted surface. A confidence threshold can help. It cannot replace provenance and confirmation.

The AudioHijack paper studies auditory prompt injection against audio language models. The Day 6 pattern makes a narrower product claim. It covers the staged evidence shape where uncertain transcript content reaches an action path after its warning context disappears.

GLS-IP-005 covers an image only perturbation that changes shared multimodal integration state while another input appears separate. GLS-UINJ-004 covers a harmless looking screenshot overlay that persists as a semantic attractor. Both patterns show why the visible object and the model state must remain linked. A clean text prompt cannot certify a visual channel that changed the combined state.

GLS-MSR-002 covers a cached multimodal safety verdict rebound from one visual input to another. Store an immutable input identity with the verdict. Also store modality, defense version and policy version. A mismatch must produce a cache miss and a fresh check.

GLS-MSR-004 covers sensitive content extracted from an image and retained in multimodal memory for a later unrelated interaction. Memory is not neutral storage. Keep the original media identity, tenant, purpose and retention limit attached. Recheck disclosure policy before recall.

The multimodal defense comparison reports that defense performance varies across attack classes. It also reports benign refusal costs for some combined defenses. That work supplies broad context. The staged patterns supply the bounded release receipts.

Reject parser ambiguity

A parser must not silently choose which security fact controls an AI agent action.

GLS-DKS-002 covers a serialized answer with a repeated rubric or policy key. A last value parser can replace the decision that an earlier component inspected. GLS-DKS-003 covers a duplicate JSON member in payment metadata. A privacy sanitizer and an executor can see different views of the same bytes.

Reject duplicate security fields before normalization. Keep the raw response identity. Use one canonical schema. Bind the accepted value to the exact operation and audience. If any component cannot reconstruct the same decision from the same bytes, fail closed.

GLS-SMP-021 covers untrusted threat evidence that carries label shaped delimiters. A classifier can mistake content for its own label set. GLS-SMP-023 covers a schema valid extracted record whose threat, actor or location relations cross their source boundaries. Schema validity proves shape. It does not prove meaning or lineage.

GLS-EE-003 covers hostile agent instructions split across HTML and CSS spans. The raw view and rendered view can differ. Inspect the same canonical representation that the agent will consume. Preserve the original bytes for review. Do not let rendering rebuild a command that the earlier filter never saw.

The duplicate authorization draft provides useful adapter guidance. Its exact SaaS approval collision is not named in the Day 6 staged list. The page claims coverage only for the two listed duplicate key shadowing patterns. It does not turn that older draft into a third shipped duplicate key mechanism.

Keep attestations scoped

An attestation proves only the subject and conditions recorded when the check ran.

GLS-ALP-002 covers a security assessment that remains reusable after the assessed target scope changes. GLS-ALP-005 covers a local unit proof accepted as safety authorization for another component. Both failures widen a valid result beyond the object it tested.

GLS-ALP-003 covers a trusted model watermark that an attacker preserves or reproduces through a variant. The mark can survive while the security meaning changes. Verify model identity, artifact digest, build lineage and current policy. Do not use the visible mark alone as release authority.

GLS-PCF-673 covers one attacker controlled citation copied under aliases and counted as independent support. Deduplicate evidence by source identity and claim lineage. Ten links that trace to one source still provide one source.

GLS-PCF-675 covers unsafe intent seeded by one compromised peer and echoed into shared coordination state. GLS-PCF-676 covers a model supplied reliability or safety score rendered as an approval badge. GLS-PCF-681 covers fused diagnostic, profile and recommendation output that crosses source boundaries. Each case needs a graph of origin and transformation. A polished aggregate must not hide the weak edge.

The practical rule is strict. Save the assessed subject, digest, component, source set, policy version, limits and expiry with every approval artifact. Recheck all of them when the artifact moves.

Verify delegated evidence

Delegated workers can collect evidence. A separate authority must decide whether that evidence changes trusted state.

GLS-CAI-717 covers cooperating agents that encode shared state through ordinary tool selection, omission, ranking and result order. A log of text messages can miss this channel. Record tool choices and omitted candidates as decision evidence. Partition shared state by authenticated task and caller.

GLS-IP-004 covers an untrusted retrieved record that copies a domain's authentic vocabulary and authority style. Familiar language does not prove origin. Verify the record source, signer, revision and current role before it can guide a consequential action.

The delegated review draft shows a related design risk. A ranked result may carry fields such as clean, finding_count=0 or risk_score=low. Treat those values as source claims. Require proof that an independent review ran against the exact artifact. Preserve conflicts instead of letting a reducer overwrite them.

No staged Day 6 ID names that exact delegated evidence reducer mechanism. The controls are useful design context. They are not a scanner coverage claim for that draft.

Bound resource requests

Agent input must not decide how much compute, memory, storage or work the host will consume.

GLS-DOAS-001 covers request metadata such as batch size, recursion or fan out that becomes execution cardinality. GLS-DOAS-002 covers many ordinary requests that pass local admission checks but exhaust a shared budget together.

GLS-DOAS-003 covers a rendered continue or load more control promoted from display state into generated work. UI state is not permission for an unbounded loop. Set a hard work budget outside the model and decrement it at every expansion.

GLS-DOAS-004 covers a compressed audio upload that passes a compressed size check but expands without a safe decoded bound. GLS-DOAS-005 covers an unauthenticated upload path with no cumulative storage quota. Check both wire size and materialized size. Authenticate the caller. Enforce per task, per tenant and global limits.

Return a bounded error when the budget ends. Do not ask the same model that requested more work whether more work is safe.

Resolve effective privilege

Permission checks must evaluate the final combined runtime rather than each input fragment alone.

GLS-PE-006 covers benign personalization and workspace configuration fragments that merge by precedence into a setting with weaker review. Validate the effective configuration after all overlays apply.

GLS-PE-007 covers a host with dynamic library environment allowances and disabled library validation. The dangerous privilege comes from the combination. Inventory launch flags, environment inheritance, signing rules and loaded code as one execution contract.

GLS-PE-008 covers a policy that inventories only direct tool permissions while an unresolved indirect path reaches more power. Expand the permission graph before approval. Include wrappers, delegates, plugins, child processes and tools called by other tools.

GLS-MMP-003 covers a malicious federated parameter update shaped to look graph correlated and benign. GLS-MMP-004 covers fabricated historical scan telemetry that steers a learned decision. Model update metadata is evidence. Verify participant identity, training window provenance, expected distributions and independent safety results before promotion.

Bound the four context mechanisms

Four source draft mechanisms add useful controls but do not map to an exact Day 6 staged ID.

The red team process trace draft studies a historical refusal to success route that advances a current attempt and suppresses a finding. Keep historical matrices read only. Require a fresh decision for the live attempt. The process mining paper supplies the research context. This page makes no Day 6 coverage claim for process trace state promotion.

The safe data coverage draft studies compact safety data that omits a required risk category. Define required strata before selection. Verify coverage outside the component that made the manifest. The SPARD paper supplies the model update context. This page makes no Day 6 coverage claim for safety selection coverage starvation.

The duplicate authorization draft studies opposite approval outcomes from first value and last value parsers. Day 6 ships two adjacent duplicate key patterns. It does not stage that exact SaaS adapter mechanism.

The delegated review draft studies retrieved clean metadata promoted into a reviewer verdict. Day 6 ships related provenance and cross agent patterns. It does not stage that exact delegated evidence reducer mechanism.

These four drafts are part of the merged design story. None appears in SHIP META. The 18 gate cards that failed intake receive no coverage claim anywhere on this page.

Read the Day 6 evidence

The Day 6 gate passed exactly 29 patterns. Those IDs appear in SHIP META in the same order as the staged release file.

The passed set contains 3 attestation lineage patterns, 1 cross agent pattern, 2 duplicate key patterns, 5 denial of AI service patterns, 1 encoding evasion pattern, 3 indirect prompt injection patterns, 2 MLOps metadata patterns, 2 memory replay patterns, 4 provenance chain patterns, 3 privilege escalation patterns, 2 structured metadata patterns and 1 UI injection pattern.

That count is a release receipt. It is not universal category coverage. It does not prove that every alias, parser, media format, model, deployment or split record will match.

Two source mechanisms have direct staged matches. Cached multimodal verdict rebinding maps to GLS-MSR-002. Low confidence transcript action handling maps to GLS-IP-003. The other four draft mechanisms remain bounded context as stated above.

Sunglasses is a content layer input filter for AI agents. The shipped matchers can filter their bounded hostile evidence shapes before the agent reads or acts. Trusted application code must still enforce identity, parser consistency, quotas, memory policy, least privilege and final action approval.

Use this implementation checklist

1. Assign immutable identity to every media object, model, record, task and component.
2. Preserve ASR confidence and audio source for every transcript segment.
3. Show action bearing transcript text before trusted confirmation.
4. Bind cached safety verdicts to the exact input, defense and policy.
5. Recheck sensitive multimodal memory before later disclosure.
6. Reject duplicate security fields before normalization.
7. Inspect the rendered representation that the agent will consume.
8. Keep structured labels bound to the evidence that produced them.
9. Bind every attestation to subject, scope, digest, policy and expiry.
10. Deduplicate citations by original source and claim lineage.
11. Treat model scores and badges as evidence rather than approval.
12. Record tool selection, omission, ranking and result order.
13. Verify delegated findings against the exact underlying artifact.
14. Set hard budgets for recursion, fan out, pagination and batch work.
15. Check decoded media size and cumulative upload storage.
16. Resolve effective configuration after all overlays apply.
17. Expand direct and indirect tool permissions before approval.
18. Verify model update participants, telemetry windows and safety evidence.
19. Run the final policy check immediately before each side effect.
20. Save the source, transforms, decision and result as one receipt.

Keep the claims bounded

Each shipped pattern matches one bounded evidence shape at the content layer. It does not prove that every transcription path, parser, attestation store or delegation bridge fails the same way. It does not replace authentication, resource quotas or policy checks at dispatch.

To see how the shipped scanner makes its own decisions explainable, read how Sunglasses works and the pattern manual. The CVP runs show the same evidence discipline applied to real repositories. The FAQ covers what the scanner does and does not claim.

Sources