THE SHORT ANSWER
Give an agent the least privilege required for the current task. Separate read from write, keep secrets outside model context, validate tool inputs, isolate risky execution, require approval for consequential actions and record auditable outcomes. Treat external content and tool metadata as untrusted.
Make the allowed action set small
| Layer | Control | Example |
|---|---|---|
| Identity | Who is acting? | User-scoped or service identity |
| Capability | Which tool is available? | Read calendar without create-event |
| Resource | Which data is reachable? | One workspace or folder |
| Operation | What change is allowed? | Draft but do not send |
| Time and volume | For how long and how often? | Short-lived access and rate limit |
| Approval | Who authorises consequence? | Named reviewer for external communication |
Treat content as data, not authority
An agent may read web pages, documents, emails and tool descriptions that contain instructions. Those inputs can conflict with the user's goal or attempt to redirect tool use. The host should keep trusted policy separate, label untrusted content, restrict available tools and require approval before sensitive actions.
Do not rely on a prompt saying ‘ignore malicious instructions’ as the entire defence. Enforce access and validation outside the model and minimise the information each server or tool receives.
Evidence & context: Model Context Protocol · Model Context Protocol · NIST
Keep credentials outside the model loop
- Store secrets in an appropriate server-side secret system.
- Use short-lived, audience-bound credentials where supported.
- Never place raw credentials in prompts, logs or tool results.
- Redact sensitive arguments while retaining useful audit metadata.
- Rotate and revoke access through the identity system.
- Prevent one connector from receiving another connector's context.
Evidence & context: Model Context Protocol
Plan for detection and containment
Log tool proposals, approvals, execution status and resulting state. Alert on unusual volume, repeated denial, unexpected destinations and budget exhaustion. Use sandboxes for code or file operations where isolation helps, and design rollback or compensating action for reversible writes.
Sources & further reading
- Generative Artificial Intelligence Profile (NIST AI 600-1)
NIST. Risk-management guidance, including confabulation. It does not establish a universal error rate.
- Model Context Protocol architecture
Model Context Protocol. The official protocol architecture checked 13 September 2026. It describes hosts, clients, servers and capability negotiation; it does not make every connected tool safe or appropriate.
- Model Context Protocol tools
Model Context Protocol. The current official tools specification checked 13 September 2026. Draft details can change; OpenSkool relies on the durable separation between tool discovery, model selection and host-controlled execution.
- Model Context Protocol authorization
Model Context Protocol. Official authorization requirements and security considerations. Authentication and authorization remain implementation responsibilities; protocol support is not permission to expose a capability.
Examples and exercises are illustrative unless attributed to a source. No independent expert review is claimed.
A correction, a counterexample or an experience worth sharing?
Join the conversation ↗