Prompt injection: access and controls for AI agents

AI agents can be tricked by prompt injection. You can reduce the risk and limit the harm by keeping access narrow and putting controls in the systems they use. A prompt that says “be careful” is not an access control.

These steps do not make an agent immune. They help you set limits on what it can reach and do if an attack works.

What is prompt injection?

Prompt injection is an attempt to make AI follow instructions from the wrong source. Someone puts a command in content the agent reads, such as an email, web page, or file. The command tries to steer it away from your task.

The text does not have to be hidden from view. It may look like a normal note or an urgent request. The risk comes from treating that content as an order, rather than as material to read.

Anthropic describes this risk in its research on prompt injection defenses. It says the problem is not solved. Better model defenses can help, but they do not remove the need for limits outside the model.

A simple example

Say you ask an agent to read vendor emails and draft a short summary. One email tells it to find private files and send them to a new address.

That is an attack, not a new task from you. This is a made-up example, not a client result.

The harm depends in part on what the agent can reach. If it can read only one shared inbox, it has less data to expose. If its tool cannot send mail, that tool cannot carry out the send. Other allowed tools or web access may still give it a way to leak data. Check the full setup, not just one button.

Keep private agents separate from shared work

Your executive agent should not double as a shared assistant for the whole company. Keep your personal agent separate too.

Give each shared agent its own approved job and access. Do not let staff use an executive agent's private session or account for routine work. A new chat alone does not prove that files or permissions are separate.

Check who can use each agent, which account its tools use, and which files it can read. Keep private notes and records out of the shared setup unless there is a clear, approved need.

This can reduce exposure. It does not stop an attack in content that an agent is allowed to read.

Give it only what the job needs

The rule is often called least privilege. It means granting only the access needed for the task.

For a first test, you might allow the agent to:

• Read one approved folder, not a whole drive.
• View records without editing them.
• Prepare a draft without sending it.
• Use a test copy instead of a live system.

Set those rights in the connected tools, accounts, and file system. Do not give the agent broad access and rely on a written rule to keep it from using that access.

Anthropic's guide to containing agents explains this distinction. Model rules shape behavior. Enforced system limits restrict what the agent can do. Its guide also describes why those limits need testing.

Require review before high-impact actions

Require human approval before an agent sends sensitive data, moves money, changes access, or edits important records.

The approval step should show the exact action. Show the recipient, data, amount, or record change so a person can check it. A vague “continue” prompt is not enough context for a sound review.

Enforce the gate outside the agent's own instructions. The account or tool should block the action until the required approval is present. Test that the agent cannot take another allowed path to the same action.

Keep the review focused. Too many routine prompts can make people stop paying attention. Human review is one layer, not a guarantee.

Check the limits before you expand access

Use test data you are allowed to use. Try a normal task and a harmless test file that asks the agent to break a rule. Check both its response and the tool's access limits.

Confirm that blocked reads, sends, and edits really fail. Keep logs. Name who can stop the agent and remove its access if something goes wrong.

Start with one task and a small set of rights. Add more only when the work needs it and the checks pass. The goal is to reduce risk and cap possible harm, not to claim that prompt injection has been fixed.