Overview › 6Topologies › c.Separating privileges

Separating privileges

Separate roles by trust and privilege. 2 optimizations.

1. i.

   Code-then-execute (CaMeL)

   Have a privileged model turn the trusted request into a small program before any untrusted data is read, then run it in an interpreter that labels every value with where it came from and checks a per-tool policy before each call, so injected text can neither add actions nor send private data to the wrong place.

   More secureBetter governanceMixed costLower qualitySlower

   Tier 4 · restructuring · changes guardrails · any agent · 7 sources, 5 measured

2. ii.

   Plan-then-execute

   Have the agent fix its tool calls (an ordered list or a dependency graph) from the trusted request before it reads any tool output, and let a controller execute only those calls, so injected text cannot add an action.

   More secureBetter governanceBetter for brandMixed qualityMixed costSlower

   Tier 4 · restructuring · changes guardrails, control flow · any agent · 6 sources, 4 measured