Threat map

List the untrusted content, the sensitive data and the outward actions. Then review each agent session. If a session has all three, you have two options: cut one or add a human approval.
It also covers prompt injection: hidden text in some content that gives orders to the agent. And it covers tool permissions, including MCP servers. MCP is a protocol to connect tools to an agent.
Copy the block with the button in its corner, or open the file on GitHub.
# Threat map: [agent name]

<!--
How to use this template:
- Fill it in before the agent gets access to real tools.
- Starting assumption: an attacker gets the agent to read text they wrote.
  A filter or attack detector lowers the risk, but it doesn't count as a defense.
- The defenses that count don't depend on the model: permissions, separation and human approval.
-->

- Date: [YYYY-MM-DD]
- Author: [name]
- Reviewed by (security): [name]

## 1. Untrusted content

<!--
Anything an outsider can write is untrusted: emails, web pages, tickets, PDFs,
API responses and third-party tool descriptions.
-->

| Input | Who can write it | Trusted? |
|---|---|---|
| [e.g. ticket body] | [any customer] | no |
| [...] | [...] | [...] |

## 2. Sensitive data

| Data | Kind (personal, financial, secret, internal) | Tool that reads it |
|---|---|---|
| [e.g. order history] | [personal] | [orders.read] |
| [...] | [...] | [...] |

## 3. External or state-changing actions

<!--
Any request to a URL counts as an external action, the same as a message.
For example: a search, a fetch, a markdown image, a link that gets previewed
or a trace sent to a third-party tool. An attacker can put data into that URL.
-->

| Action | Tool | Reversible? | Maximum scope |
|---|---|---|---|
| [e.g. email the customer] | [email.send] | no | [one recipient] |
| [e.g. render a markdown image with a URL the model builds] | [chat reply] | no | [allowlisted domains only] |
| [...] | [...] | [...] | [...] |

## 4. The trifecta, session by session

<!--
The trifecta is three conditions together: untrusted content, sensitive data and external actions.
A session is everything the agent has in context at once.
Requesting a URL already counts as an external action (see section 3): a search or an image counts.
If a session combines all three columns, cut one or add a human approval.
-->

| Session or flow | Untrusted | Sensitive | External | All three? | What we cut and how |
|---|---|---|---|---|---|
| [e.g. answer ticket] | yes | yes | yes | yes | [the reply goes through human approval] |
| [...] | [...] | [...] | [...] | [...] | [...] |

Ways to cut one of the three:

- Split into two steps: one reads the untrusted content with no action tools. The other acts without seeing that content, using data that is already structured.
- Remove access to sensitive data in the session that reads outside content.
- Limit outputs to a closed menu of actions or to fixed destinations (for example, an allowlist of domains).
- Require human approval bound to the exact action. See politica-de-acciones.md.

## 5. Prompt injection

<!--
Prompt injection: text inside the data that the model follows as if it were an instruction.
For each scenario, assume the attack works. Write down what stops it.
-->

| Scenario | What the attacker gets if it works | Control that stops it (outside the model) |
|---|---|---|
| [e.g. a ticket asks to forward the history to another address] | [personal data leak] | [email.send only to the order's owner] |
| [e.g. a PDF asks to approve a refund] | [money loss] | [refund at confirm level, with a cap] |
| [...] | [...] | [...] |

## 6. Tool permissions (including MCP)

<!-- MCP (Model Context Protocol) is a protocol to connect tools to the agent. -->

| Tool or server | Owner | Pinned version (hash: a unique fingerprint of the content) | Identity it uses | Credential scope | Read / write |
|---|---|---|---|---|---|
| [...] | [...] | [...] | [the agent's own identity, with permissions delegated by the user] | [...] | [...] |

- [ ] Every MCP server is in an inventory with an owner and a written decision.
- [ ] The agent uses its own identity and permissions delegated by each user. Those permissions are never broader than the user's.
- [ ] Remote MCP servers (over HTTP) authenticate per user, with OAuth (a standard to delegate permissions) and scopes. No shared keys.
- [ ] Local MCP servers (stdio, on the same machine) take credentials from the environment. Those credentials belong to the agent and are minimally scoped.
- [ ] Each server accepts only tokens issued for it and doesn't pass tokens on.
- [ ] We reviewed each tool's full description and pinned it by hash. If it changes, we disable it until we review it.
- [ ] No wildcard permissions ("all tools").
- [ ] Local servers run isolated (sandboxed), without network or file access they don't need.
- [ ] We don't send secrets or personal data to third-party servers without a contract.

## 7. Remaining risk

| Risk | Why we accept it | Who accepts it | Review date |
|---|---|---|---|
| [...] | [...] | [...] | [...] |

## Why this is here

- With private data, untrusted content and external communication together, filtering injections is not enough. The safe defense is not to combine them: *New prompt injection papers: Agents Rule of Two and The Attacker Moves Second* (Simon Willison, 2025) and *Agents Rule of Two* (Meta, 2025).
- The leak can be a request to a URL on an allowed domain, or an image that loads on its own: *Google Antigravity Exfiltrates Data* (Simon Willison, 2025) and *Microsoft Copilot Cowork Exfiltrates Files* (Simon Willison, 2026).
- Adaptive attacks (attacks that change to match the defense) broke 12 published defenses, with over 90% success against most of them: *The Attacker Moves Second* (Nasr et al., 2025).
- A tool description can make the agent use a different tool, with more permissions, to do the damage: *MCP-ITP* (Li et al., 2026). A legitimate MCP package can turn malicious in a new version: *MAL-2026-4069* (OSV, 2026).
- In MCP, authorization is optional, with OAuth only over HTTP, and the specification can't enforce security: *Model Context Protocol Specification, revision 2026-07-28* (Model Context Protocol, 2026).