Orqestria Download
← Back to the catalog

Skill · Version 1.0.0

Agent trust boundaries

Places deterministic controls around agent tools so untrusted documents cannot freely turn access to sensitive data into external actions.

agent-permissions-trust

See how it helps

When is it useful?

Use it when an agent reads emails, websites or uploads while also holding filesystem, network or mutation capabilities.

What does it help you do?

  • Enforces tool policy outside the language model.
  • Isolates untrusted input from sensitive data and outbound actions.
  • Restricts execution paths and removes secrets from outputs.

Try asking this

Review an email-reading agent that also has external HTTP tools. Use a test email that requests uploading private files. Verify that reading the message grants neither file access nor permission to send its contents elsewhere.

Detailed documentation

Read the skill’s original instructions, examples and checks in their authored language.

Details…Show less

Agent Permissions & Trust Boundaries

An LLM cannot reliably separate instructions from data once both share the same context window. Enforce security, authorization, and blast-radius controls outside the model in deterministic application code.

The Lethal Trifecta & Capability Isolation

Prompt injection becomes a critical breach when a single agent turn combines all three capabilities:

  1. Access to private or sensitive data (customer records, credentials, internal source code)
  2. Exposure to untrusted input (emails, web pages, public issues, third-party tool outputs, uploaded files)
  3. Ability to trigger external side effects or exfiltration (sending HTTP requests, emails, messages, mutating databases, or rendering external image URLs)

Whenever an agent processes untrusted content, either strip outbound/mutating tools from that execution step or gate every side effect through a deterministic policy verifier or human confirmation.

Policy Enforcement & Approval Tiering

Enforce a deterministic policy check in the tool dispatcher before invoking any handler:

Risk Tier Tool Examples Mandatory Enforcement
Tier 0: Read-Only / Scoped Workspace file read, scoped search, schema inspection Path canonicalization (realpath), workspace root boundary check, denylist on .env/secret paths
Tier 1: Reversible Local Write Editing project source files, running unit tests in sandbox Workspace jail, resource quotas (CPU, memory, timeout), diff recorded in audit log
Tier 2: Shared / External Mutation Sending messages, creating tickets, writing to shared DB, API POST/PUT Caller identity propagation (OBO token), schema + policy allowlist, idempotency key, rate limit
Tier 3: Destructive / Privileged DROP/DELETE, production deploy, secret access, arbitrary network egress, payment actions Pause run in awaiting_approval (deferToolCall), display exact canonical arguments/diff to human approver, verify cryptographic or session-bound approval before execution

Non-Negotiable Security Invariants

  1. Never pass raw secrets into model context: Keep API keys, database passwords, OAuth tokens, and private keys in the host credential store. Tools reference credentials by logical handle or the host injects headers at the HTTP boundary—never as tool arguments generated by the LLM.
  2. Canonicalize before checking policy: Validate paths after resolving symlinks (fs.realpath) and URLs after DNS resolution (blocking RFC1918, loopback, and cloud metadata 169.254.169.254 to prevent SSRF).
  3. Constrain command and code execution: Avoid shell interpolation (sh -c with model strings). Pass argument arrays (execFile), sanitize environment variables (PATH, LD_PRELOAD, secret env vars), and run untrusted code inside isolated sandboxes or containers with read-only root filesystems and restricted egress.
  4. Redact logs and tool outputs: Scrub bearer tokens, cookies, connection strings, and PII from tool_result payloads and trace spans before they enter the prompt or telemetry storage.

Included files 1

  • SKILL.md

About this skill package

agent-permissions-trust

agent-permissions-trust: Build AI agent features with explicit tool contracts, controlled permissions, durable state and observable model behavior.

Details…Show less

agent-permissions-trust

agent-permissions-trust: Build AI agent features with explicit tool contracts, controlled permissions, durable state and observable model behavior.

Includes the complete skill and its supporting files (1 files). The exact authored scope is preserved below.

Original skill description (source language)

Use when defining agent permission boundaries, defending against indirect prompt injection, enforcing human-in-the-loop approvals, sandboxing code or command execution, or handling secrets in LLM workflows.

Install the skill, review its source and trust settings, then enable it for the relevant project or agent.

Requirements

  • Orqestria installed on your computer.