Agent-ready workflow · ai
AI Agent and Tool Trust
Trace untrusted content through prompts, retrieval, memory, tools, approvals, and output sinks to a measurable controlled effect.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- RAG
- tool call
- MCP server
- agent memory
- browser action
- external content
Prerequisites
- controlled content
- test account
- tool privilege inventory
- effect rollback
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Map trust and privileges
Record system instructions, user input, retrieved content, memory, tool schemas, approvals, secrets, and output consumers.
Inputs
- approved AI feature
Outputs
- trust-boundary map
- tool privilege table
- Evidence gate
- Every tool has inputs, allowed effects, approval state, and data access noted.
- Negative control
- Plain model influence is separated from tool or sink effects.
- Stop condition
- No uncontrolled emails, messages, purchases, or external changes.
Plant a benign instruction canary
Use controlled content to test whether untrusted instructions cross a named boundary.
Inputs
- controlled document or record
Outputs
- instruction-following evidence
- Evidence gate
- The canary identifies its source and does not request secrets or privileged actions.
- Negative control
- A matched document without the instruction produces normal output.
- Stop condition
- Prompt influence alone is not reported as security impact.
Test one controlled effect
Ask whether the influenced model can cause a reversible tool call, unsafe render, URL fetch, or memory change.
Inputs
- supported injection path
- controlled effect target
Outputs
- tool or sink evidence
- Evidence gate
- An unauthorized effect is observed and attributable to the controlled input.
- Negative control
- Approval, policy, or schema control blocks the same action when intact.
- Stop condition
- No secret disclosure or actions affecting third parties.
Bound the chain
Separate instruction following, tool selection, argument control, authorization, effect, persistence, and data access.
Inputs
- effect evidence
Outputs
- prerequisite graph
- minimal report
- Evidence gate
- Each chain edge is observed or clearly labeled untested.
- Negative control
- Remove the untrusted content and repeat the controlled action.
- Stop condition
- Clean up memory and controlled state.
Related methods
Continue with the right depth.
Sources