Layer 04
Untrusted input shrinks authority.
Agents read web pages, emails, documents and other agents’ output. Any of them can carry instructions written by someone else. Nobody can know in advance which ones do, so StartiQOS narrows what an agent may do after reading them.
The Problem
An instruction is just more text.
An agent cannot reliably tell its task apart from text it has read.
01
Indirect prompt injection
An instruction hidden in a document reads exactly like a legitimate one, and the agent acts on it with access it was properly given.
02
Detection loses to new wording
A filter that recognises known attacks misses the next variation.
03
Trust and sensitivity are separate questions
How far to trust an input and how far its data may travel need separate answers. Mixing them over-blocks some work and under-protects the rest.
The Method
Exposure narrows permission.
Authority is tied to what the agent has read, not only to who the agent is.
01
Inputs are labelled by origin
Each tool result is marked by where it came from.
02
Taint only rises within a session
Reading untrusted content raises the session’s taint level. It does not reset mid-session.
03
Capabilities carry a taint bound
Each capability in a policy records the highest taint level it was observed working at. Above that bound, it stops being valid.
04
Kept apart from sensitivity
Taint measures trust in inputs. Sensitivity, used by composition analysis, measures how far data may travel. Separate checks enforce each.
Example session
session s-4812 taint 0 ledger.invoices.read ✓ doc.fetch.external taint → 3 mail.send.external bound 1 ✗ DENIED taint 3 exceeds bound 1
Questions
Provenance, explained.
No single layer can. It limits what an injected instruction can do by removing the capabilities the agent would need, instead of trying to spot the instruction.
A record of how much untrusted material has entered an agent’s context during a session. As it rises, capabilities that require a clean context stop being valid.
It can, when one session mixes untrusted reading with sensitive actions. The call is denied and recorded. Split unrelated work into separate sessions, or ask the approver to change the policy.
Find out what your agents
are actually allowed to do.
Early access starts with a two-week shadow-mode pilot. Nothing is blocked. You get the gap between the access each agent holds and the access it uses, and every combination that could move data out.