Trust boundaries
A trust boundary is a line where data from a less trusted source enters a part with more power. A filter that blocks 95 percent of known attacks still lets new wording through. A separate reader with no tools keeps untrusted text away from the parts that act.
See it on the board
The same traffic runs on two boards. The simulator measured both when this page was built.
| Measure | Goal | Agent reads pages and holds the tools | Separate reader with no tools handles pages |
|---|---|---|---|
| p99 latency (Tasks) | under 4 s | 2.7 s Pass | 2.7 s Pass |
| Error rate (*) | under 1% | 0% Pass | 0% Pass |
| Monthly cost | 24 USD/mo | 24 USD/mo | |
| Error rate | 0% | 0% | |
| Level rules | none broken | Board is not complete Fail | Pass |
Key numbers
| Number | Value |
|---|---|
| Share of known attacks a filter blocks, default | 0.95 fraction |
| Share of good requests a filter blocks, default | 0.005 fraction |
| Call to a language model, median | 150 ms |
| Price of one more worker | 4 USD/mo |
Separate reader · 0 of 100 attacks reach a tool
How it works
Each system takes input that it does not control: user forms, uploaded files, web pages and messages from partners. A trust boundary is each point where such input meets a part with more power, such as access to a database, to money or to email.
At each boundary, decide what the input may do. Check its shape and size. Treat it as data, never as code or as an order. Classic attacks break this rule: SQL injection changes form text into a query, and cross-site scripting changes a comment into a script.
Language model agents add a new case. An agent that reads a web page and also holds tools can obey orders that hide in that page. This is prompt injection. Filters for known phrases help a little, but an attacker can always write new words. Separation is safer. A reader with no tools changes the untrusted page into a summary. The agent that holds the tools sees only that summary, and risky tool calls need approval.
Each boundary has a cost: one more step, more latency and one more part to run. Put the boundaries where the damage would be large.
In the levels you move untrusted input into a separate part that cannot act on it.