Indirect prompt injection
The attacker does not talk to your agent. They plant instructions in a document, a web page or a calendar invite the agent will later read, and the agent follows them with your permissions.
AI security · Injection · Authorisation · Supply chain
Your agent reads untrusted text. Then it calls tools with your credentials.
That sentence is the whole threat model. Anything the model reads — an email, a web page, a PDF, a ticket — is attacker-controlled input that arrives in the same channel as your instructions. The defence is not a better prompt.
- The only safe default for a tool call
- Fail closed
- Where authorisation belongs, not per session
- Per call
- The unit that actually matters
- Blast radius
The cost
The attack surface nobody inherited
Application security assumes code decides what runs. With an agent, a probabilistic model decides — and it decides using text an attacker may have written.
Authorisation granted per session
An agent authenticated once and then trusted for everything it does afterwards. The moment its input is compromised, so is every tool it can reach.
Tools with unbounded blast radius
A "send email" tool that can email anyone, a database tool with write access to every table. The model does not need to be malicious for that to end badly.
Weights and adapters with no provenance
A fine-tune pulled from a hub, an adapter from a vendor, a quantised checkpoint from a mirror. Model supply chain is where application supply chain was a decade ago.
The build
What we build
Controls that sit between the model's intention and the action, because that is the only place they cannot be talked out of.
Per-call authorisation
Every tool call evaluated against policy at the moment it is made, with the arguments in hand. Session-level trust is not a control.
Trust boundary on model input
Untrusted content marked as data, never as instruction, and structurally separated from the system prompt, never concatenated into it.
Blast-radius scoping per tool
A tool that can reach every record is a tool that will. Scope, rate-limit and constrain each one to the smallest surface that still does the job.
Human gate on irreversible actions
Payments, deletions, external communication. Bound to a canonical hash of the arguments so approval cannot be reused for a different payload.
Model supply chain
Provenance, checksums and a pinned registry for weights and adapters, with the same seriousness you already apply to packages.
Evidence ledger
Every decision appended and redacted, so an incident can be reconstructed instead of guessed at.
The economics
Where the money moves
Security economics are asymmetric: the control cost is known and bounded, the incident cost is neither. The lever is containment.
- 01Blast-radius scopingConverts a potential breach into a contained one. This is the single highest-value control and it is configuration, not a product purchase.
- 02Per-call authorisationRemoves the entire class of "compromised session" outcomes. A compromised input reaches one call, not a whole estate.
- 03Human gate on value movementThe last line. Cheap to run at low volume, and it is the control that stops the incident you would have to disclose.
- 04Reconstructable evidenceDetermines whether an incident takes a day or a quarter to understand, and whether you can state its scope confidently to a regulator or a customer.
Why this firm
We built this control for ledgers first
Issa exists because of this page. Policy before execution, evidence after, and a human on anything irreversible — first built for ledger writes, and it is the same control an agent estate needs.
Questions
Answered straight
No, and treating it as a prompt-engineering problem is the common mistake. Instructions and untrusted data arrive in the same channel; the fix is architectural — separate the channels, authorise the action, do not trust the intention.
An API gateway authorises the caller. This authorises the specific call, with its arguments, against policy — because the caller is legitimate and the arguments are what an attacker influenced.
Inventory the tools your agents can reach and write down the blast radius of each. Most teams discover a tool with far more reach than anyone intended, and that finding alone justifies the exercise.
Issa is open source and you can run it yourself. We do enterprise audits of agent estates and the integration work; the gateway is not licensed.
Next
List every tool your agents can call.
If that list is hard to produce, it is the finding. We audit agent estates: what is exposed, what the blast radius of each tool is, and where a human gate belongs.