AI Agent Trust Boundaries for Data and Actions

Use one trust model

Every risky flow on this page shares one mistake. A system receives data and lets that data grant its own authority.

A model says a stale session is valid. An MCP request supplies an identity token and treats possession as authentication. A delegated worker reports complete. A tool result claims its evidence is verified. A memory changes a later tool parameter. A retrieval summary drops the limits that made a result valid.

Structure does not fix the problem. JSON can carry a false label. A typed object can carry a command argument that a shell reads differently. A valid session ID can belong to the wrong client. A well formed vector can come from another tenant or another embedding version.

The fix is an independent decision at the final boundary. Trusted code must identify the current subject, operation, resource, evidence, policy and runtime. It must compare them after all parsing and routing finish. It must fail closed when any binding is missing or stale.

1. Identity boundary. Prove who controls the current connection and session.
2. Action boundary. Bind approval to exact typed arguments and the final executor.
3. Evidence boundary. Keep delegated output advisory until independent review promotes it.
4. Memory boundary. Recheck stored content under current policy before reuse.
5. Disclosure boundary. Release only fields the current requester may receive.

Keep sessions outside model control

Session validity must come from trusted identity state. Model output and bearer identifiers are not proof of a current authenticated client.

GLS-AB-007 covers a poisoned checkpoint that emits an accepting result for an expired or revoked session. The accepting word looks normal. It cannot renew authority. The runtime must check current expiry and revocation before reuse, forwarding or an authenticated call.

GLS-AB-009 covers an MCP transport that accepts initialization and tool calls without authentication. A protocol handshake can establish syntax and capabilities. It does not establish identity. The server must authenticate the peer before it creates protected state or accepts a call.

GLS-AB-011 covers a streamable HTTP or SSE design that treats a valid session ID as client identity. Another client can present the identifier. The server must bind the session to the authenticated principal, tenant, connection rules and current scope.

Check sessions at the sink. Validate audience, principal, tenant, expiry, revocation and requested operation. Rotate or restart state without carrying old authority forward. Log the model recommendation separately from the runtime decision.

The SafeTune paper shows how poisoned fine tuning data can produce insecure learned behavior. OWASP LLM04 for 2025 covers the wider data and model poisoning risk. Neither source claims this exact session failure. The Day 5 pattern supplies that bounded operational mechanism.

Bind MCP calls to safe execution

A structured tool call stays unsafe when its final command has a different meaning. Approval must bind the exact operation that the executor will consume.

GLS-CI-008 covers a model assigned safe class and automatic approval field that authorize a command template. A label cannot approve the rendered command. Trusted code must render first, parse the final action and apply policy to that exact result.

GLS-CI-011 covers an MCP output path joined into a shell command. String concatenation lets data cross into command syntax. Pass arguments as an array to a direct process API. Keep the shell out of the path.

GLS-CI-014 covers an MCP server name that looks like one inert install argument before a Windows command shim flattens it. The shim changes the parsing boundary. The safe design uses a direct executable, a fixed argument vector and platform specific tests for every wrapper in the chain.

GLS-CI-015 covers a structured git reference or path that starts with a dash and becomes an option. Add the tool specific option terminator when supported. Validate allowed forms. Keep data after fixed options. Do not assume one argument means one harmless operand.

These patterns make one point. Validate the executor view. Record the canonical command, argument vector, working directory, environment, caller and policy version. Reject automatic approval that depends on a model supplied safety label.

Treat delegated results as evidence

A delegated result is evidence until a separate authority accepts it. Fluency, schema validity and a complete label cannot promote it by themselves.

GLS-DBSL-001 covers a compromised outside labeling worker that flips a record label. Keep the worker label, reference value, record identity and adjudication state separate. Quarantine the conflict before training or evaluation.

GLS-DBSL-002 covers a fluent review request that preserves the visible task while adding a quiet change to authority. Parse the requested operation into typed fields. Show the full delta. Reject hidden scope expansion.

GLS-DBSL-003 covers a structured tool result whose verified or complete metadata becomes workflow authority. The producer can report status. It cannot approve its own promotion. Trusted code must verify the evidence and lifecycle independently.

GLS-DBSL-004 covers a citation that has valid syntax and the correct URL while other evidence bindings drift. Verify the digest, location, quoted claim and current source. A working link proves reachability only.

GLS-DBSL-005 covers a defense result valid only under stated query, data and interface limits. Preserve those limits with the score. Do not promote a bounded result into a broad safety claim.

GLS-DBSL-007 covers an issue event that places attacker written text into a command capable transform. Treat event fields as data. Use fixed templates and direct process arguments. Never let an issue title become shell syntax.

GLS-DBSL-008 covers paired operands with mismatched lifecycle or ownership flags. Validate the pair as one operation. Both records must name compatible owners, versions and states.

GLS-DBSL-009 covers an identityless interleaved request stream that lets a stateful monitor join unrelated work. Partition state by authenticated task and caller. Never infer identity from arrival order.

MITRE ATLAS data documents private dataset label poisoning and AI inference exfiltration techniques. The Day 5 patterns narrow those broad risks into concrete workflow boundaries.

Minimize sensitive output

Private data can leak through a tiny response field or through several small fragments. The output policy must judge the whole session and final response.

GLS-EX-026 covers an API response that reveals a hidden inference policy branch or evaluator rationale. A response can disclose a private decision without returning a source record. Return only fields required by the public contract. Keep internal policy state and evaluator reasoning out of normal output.

GLS-EX-027 covers masked PII fragments that look weak alone but become identifying when linked across turns. Apply privacy rules after session level correlation. Budget cumulative disclosure. Do not let per message checks reset the risk.

GLS-EX-029 covers a skill that declares public and read only behavior but conditionally reads a local workspace. Static capability text does not prove runtime behavior. Enforce filesystem scope outside the skill. Record every effective read target.

Use an allowlisted response schema. Classify protected fields in policy that deployment data cannot rewrite. Authorize each field for the current requester and sink. Remove internal rationale, hidden branch state, raw identifiers and unnecessary numerical detail.

OWASP LLM02 for 2025 covers sensitive information disclosure. This page applies that broad guidance to response fields, cumulative fragments and effective skill access.

Recheck memory before action

Memory is stored input. Time does not turn it into trusted policy.

GLS-MP-009 covers persisted personality or bias memory that changes serialized tool parameters such as limits, timeouts or retrieval depth. Treat recalled preferences as suggestions. Validate every final parameter against current policy before dispatch.

GLS-MP-012 covers a malicious web page reaching an unauthenticated loopback dashboard API. Loopback is a network location. It is not an identity boundary. Require authentication, validate the host and origin and block unsafe browser driven state changes.

GLS-MP-013 covers a memory service that permits writes when an authentication token is empty or unset. Missing security configuration must deny access. Startup should fail when a network service lacks a valid secret or stronger identity control.

GLS-MP-014 covers a crafted email that an email tool stores in durable session memory. A later planner retrieves the content and acts on it. Preserve source provenance and trust labels. Filter hostile agent readable content before storage and again before use. Require new approval for any sensitive action derived from memory.

Sunglasses is a content layer input filter for AI agents. It can filter known hostile instruction shapes before content enters context or memory. The runtime must still enforce authentication, origin checks, parameter limits and action approval.

Preserve retrieval limits and provenance

Retrieval output becomes dangerous when compression or reuse drops the facts that bound its meaning. Keep the source, limits, dissent and vector identity attached.

GLS-RPDA-004 covers an improved aggregate calibration score promoted into coverage or release authority. A better average does not prove broad coverage. Preserve the tested corpus, thresholds, misses and release gate.

GLS-RPDA-005 covers a knowledge honeypot that sends extraction queries to decoy content. A successful redirect under one setup does not prove durable protection against other interfaces or transfer methods. Keep the threat model with the result.

GLS-RPDA-006 covers a low recall threat hunt that flags only a few malicious timestamps. A sparse hit list cannot certify the rest as clean. Report recall limits and unknown regions.

GLS-RPDA-008 covers a lossy memory or RAG summary that keeps the best adapter safety score and drops a dissenting expert result. Preserve disagreement and worst case evidence when the decision affects release or authority.

GLS-RPDA-010 covers benign retrieval fragments that pass local checks but form a restricted conclusion when combined. Evaluate the assembled context. Track cumulative sensitivity and authority across fragments.

GLS-RPDA-011 covers a stale or cross tenant vector record whose rotation epoch, dimension or embedding version no longer matches the current query path. Bind vectors to tenant, model, dimension, transform, epoch and source. Reject mismatches before similarity results enter planning.

Bound the three context mechanisms

Three assigned drafts provide useful design context but do not map to a Day 5 staged ID. This page makes no Sunglasses coverage claim for them.

The training membership draft studies an inference API that returns a record level membership score. Such a field can create a privacy oracle. Teams should remove membership specific output from normal inference and isolate authorized privacy tests. No Day 5 SHIP META ID covers that exact mechanism.

The sensitive field projection draft studies deployment configuration that requests a protected response field. Configuration can describe shape. Independent policy must authorize disclosure before serialization. No Day 5 SHIP META ID covers that exact mechanism.

The embedding reconstruction draft studies a vector record that asks an agent to recover source text without a current grant. The safe design checks authorization outside the record before reconstruction or disclosure. OWASP LLM08 for 2025 provides the wider vector security context. No Day 5 SHIP META ID covers that exact reconstruction mechanism.

These boundaries matter even without a content filter match. Response minimization, field authorization and vector access control belong in trusted application code.

Read the Day 5 evidence

The Day 5 gate passed 28 patterns. Those exact IDs appear in SHIP META in staged order.

The passed set contains 3 authentication bypass patterns, 4 command injection patterns, 8 delegation state laundering patterns, 3 exfiltration patterns, 4 memory poisoning patterns and 6 retrieval provenance decay patterns. The count is a release receipt. It is not a claim of universal coverage for any category.

Coverage applies to each bounded staged evidence shape and its shipped matcher. New aliases, split records, encoded fields, changed parsers and state outside the content layer still need direct controls and continued testing.

The five source drafts do not become five coverage claims merely because they were merged. The poisoned session mechanism maps to GLS-AB-007. Outsourced label poisoning maps to GLS-DBSL-001. The three mechanisms named in the prior section remain context only.

Use this implementation checklist

1. Authenticate every MCP connection before protected initialization or tool use.
2. Bind session state to the principal, tenant, scope, expiry and current connection rules.
3. Keep model output outside expiry and revocation decisions.
4. Render and parse the final command before approval.
5. Use direct process arguments instead of shell string assembly.
6. Validate command operands under the target tool and platform rules.
7. Keep delegated labels, reviews and tool results as provenance bound evidence.
8. Quarantine conflicts until an independent authority resolves them.
9. Preserve query budgets, data limits and interface limits with evaluation results.
10. Partition streaming task state by authenticated identity.
11. Allowlist response fields and remove hidden policy rationale.
12. Track cumulative private data across turns.
13. Enforce actual skill file access outside static manifests.
14. Require authentication and origin controls for loopback services.
15. Fail startup when security tokens are missing.
16. Preserve memory source and trust labels through recall.
17. Validate final tool parameters after memory changes them.
18. Keep dissent, misses and tested limits in RAG summaries.
19. Bind vector records to tenant, model, dimension, transform and epoch.
20. Save the final data, policy, action and result as one receipt.

Keep the claims bounded

Each shipped pattern matches one bounded evidence shape at the content layer. It does not prove that every transport, delegate, memory store or retrieval path fails the same way. It does not replace authentication, field authorization or approval at dispatch.

To see how the shipped scanner makes its own decisions explainable, read how Sunglasses works and the pattern manual. The CVP runs show the same evidence discipline applied to real repositories. The FAQ covers what the scanner does and does not claim.

Sources