Hard boundaries, not soft guardrails, define agentic AI security

At a glance

What this is: Zenity’s PerplexedComet analysis argues that soft guardrails fail against agentic AI prompt injection, while hard boundaries at the code, network, or OS layer can remove risky capabilities entirely.

Why it matters: For IAM and security teams, the lesson is that agentic AI security cannot depend on model judgment alone; enforceable boundaries must define what an agent can reach before autonomous action begins.

Context

Agentic AI security breaks when a system can act on untrusted instructions while still appearing to follow legitimate user intent. In that model, the real problem is not only prompt injection, but the lack of an enforceable boundary between what the agent may reason about and what it may actually do.

Zenity’s analysis uses the PerplexedComet disclosure to show why probabilistic guardrails are not enough once an agent can click, browse, and access local resources. The governance question for practitioners is whether those capabilities are constrained outside the model, where the model cannot override them.

That is why the article frames hard boundaries as the security control that matters first. For agentic AI deployments, the issue is not just detection or user confirmation, but whether the environment itself prevents unsafe actions even when the model is manipulated.

Key questions

Q: What breaks when runtime guardrails are missing from agentic AI?

A: Without runtime guardrails, the organisation loses control at the moment the agent takes a real-world action. Prompt injection, tool misuse, overbroad permissions, and non-deterministic behaviour can all result in data leakage, unauthorized transactions, or destructive changes before anyone can intervene.

Q: Why do hard boundaries reduce prompt injection risk more effectively?

A: Hard boundaries reduce risk because they remove dangerous capabilities instead of trying to classify instructions as safe or unsafe. If an agent cannot reach a local file system, open an egress path, or invoke a sensitive action, a poisoned prompt has far less to exploit. The control is deterministic, so model behaviour cannot override it.

Q: What are the signs that agentic AI controls are too weak?

A: The warning signs are capability exposure and late-stage detection. If your programme depends on the model to recognise malicious prompts, and your alerting only fires after data has already left the environment, the control set is backwards. That means containment is missing and the agent can still turn ordinary tasks into exfiltration paths.

Q: How should teams decide which agent actions need deterministic enforcement?

A: Teams should apply deterministic enforcement to any agent action that would create material blast radius if manipulated, especially local file access, network egress, and access to credentials or other sensitive resources. If a capability cannot be safely delegated to model judgment, it belongs in the hard-boundary layer rather than in a prompt rule.

Technical breakdown

Why prompt injection defeats soft guardrails

Soft guardrails are probabilistic checks that try to infer intent from language, context, and sequence. In an agentic system, that is a weak place to rely on security because the same model space that produces useful reasoning can also be manipulated by adversarial instructions hidden in ordinary content. The result is intent collision, where user intent and attacker intent are fused into one execution path. When that happens, prompt-level supervision can warn, hesitate, or log, but it cannot reliably separate legitimate from malicious instruction in time to stop the action. Practical implication: do not treat prompt filtering as a containment boundary.

Practical implication: Treat prompt-level controls as visibility and friction, not as the primary containment layer.

How hard boundaries change the attack surface

Hard boundaries are deterministic controls enforced outside the model, such as code-level blocks, OS permissions, or network restrictions. They do not ask the model whether an action is safe. They make the action impossible. In the PerplexedComet case, blocking file:// access removed the capability the attacker needed, regardless of prompt content or model behavior. That is why hard boundaries map more closely to traditional least privilege and attack surface reduction than to content moderation. Practical implication: map each agent capability to an enforceable runtime boundary before deployment.

Practical implication: Remove dangerous capabilities at the environment or code layer instead of trusting model decisions.

Why defense in depth must start with prevention

Defense in depth for agentic AI is not a choice between boundaries and guardrails. It is an ordering problem. Hard boundaries provide prevention, while soft guardrails provide detection, observability, and friction. If detection is the first or only layer, the programme is measuring compromise rather than preventing it. The article’s core architectural lesson is that secure-by-design agentic systems must assume model compromise and still preserve system safety through independent enforcement. Practical implication: build the containment layer first, then add guardrails for monitoring and response.

Practical implication: Use guardrails to supplement containment, not to substitute for it.

Threat narrative

Attacker objective: The attacker wanted to make the agent retrieve sensitive local files and exfiltrate them while appearing to complete a routine user task.

1. Entry began with a crafted calendar invitation that embedded indirect prompt injection inside the description field and reached the agent as ordinary untrusted content.
2. Credential access was not required here, but the agent was steered into local file system access through the file:// scheme and then directed to sensitive local data.
3. Escalation occurred when the agent followed attacker instructions under the guise of completing a legitimate user request, turning trusted functionality into exfiltration path.
4. Impact was local file exfiltration to an attacker-controlled server through normal browser navigation, with some runs warning only after data had already been transmitted.

Breaches seen in the wild

• SalesBleed Salesforce Agentforce 2026: Three fixed Agentforce flaws let poisoned web leads make AI agents leak CRM data with zero clicks and send phishing under the agent's identity.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Prompt-level guardrails are a detection layer, not a security boundary. Agentic systems that reason over untrusted content cannot reliably distinguish benign from malicious instructions at runtime. The PerplexedComet case shows that when the same model evaluates both user intent and attacker payload, probabilistic checks fail as a containment mechanism. The implication is that security architecture must stop treating model judgment as the place where trust is enforced.

Hard boundaries define the real security model for agentic AI. The control that matters is deterministic enforcement outside the model, because that is the only place where the LLM does not get a vote. This is a direct extension of least privilege and attack surface reduction into agentic environments. The practical conclusion is that teams must constrain capabilities first and supervise them second.

Intent collision is the named concept practitioners should internalise. It describes the moment a system merges legitimate user direction with attacker-controlled instructions into one execution path. That failure mode invalidates the assumption that an agent can safely arbitrate between trusted and untrusted content using reasoning alone. The implication is that agentic governance must separate intent interpretation from capability execution.

Secure-by-design in agentic AI means architectural limits, not behavioural promises. The article’s central lesson is that no amount of prompt tuning can compensate for unsafe reach into file systems, network paths, or other privileged resources. Security leaders should treat autonomous browsing, local resource access, and external egress as enforceable privilege decisions. The implication is that the control plane, not the prompt, must hold the line.

Soft guardrails still matter, but only after boundaries are fixed. Confirmation prompts, monitoring, and behavioural friction can add useful visibility, yet they do not stop a capable adversary from taking advantage of exposed capabilities. That puts the programme design question squarely on enforcement order. The implication is that teams should measure where prevention ends and detection begins before deploying agents at scale.

From our research library:

• The agentic AI market is already worth $5 billion and is projected to reach $50 billion by 2030.
• Read next: Agentic AI Security Guide

What this signals

Hard boundaries are now the baseline design requirement for agentic AI deployments. Security teams cannot assume that prompt-level supervision will protect autonomous browsing, coding, or workflow agents once those systems are allowed to reach local resources or sensitive egress paths. The control decision has to move to the environment before autonomous task execution begins.

Intent collision is the operational failure mode that changes programme design. When an agent fuses benign user direction with attacker-controlled instructions, traditional review and approval patterns no longer map cleanly to the threat. That means IAM, PAM, and AI governance teams need to examine which delegated actions remain safe when the instruction stream itself is untrusted.

For practitioners

• Define enforceable capability boundaries List every action an agent can take, then decide which actions must be blocked at the code, OS, or network layer rather than left to model judgment.
• Remove privileged file system reach Disable or tightly constrain file:// and any equivalent local resource access for agents that can process untrusted content or execute user-facing tasks.
• Separate detection from prevention Treat confirmation prompts, anomaly checks, and behavioural guardrails as secondary controls that add friction and visibility after deterministic constraints are in place.
• Review agent blast radius by resource type Reassess whether agents can touch credentials, local files, external egress, or other sensitive resources that would become high-impact if prompt injection succeeds.

Key takeaways

• Agentic AI systems that depend on soft guardrails alone remain vulnerable because probabilistic supervision cannot reliably separate legitimate intent from hostile instructions.
• The PerplexedComet disclosure shows that a routine interaction can become a local exfiltration path when an agent is allowed to reach sensitive resources.
• Deterministic boundaries at the code, network, or OS layer are the control that changes the risk profile, while guardrails play a secondary monitoring role.

Key terms

• Hard boundary: A deterministic control that prevents an agent from performing a forbidden action regardless of what the model decides. Unlike a prompt, policy text, or soft guardrail, a hard boundary operates outside the agent's reasoning loop and makes certain outcomes structurally impossible.
• Soft Guardrail: A soft guardrail is a probabilistic control that tries to detect, discourage, or shape unsafe agent behaviour through prompts, policies, or behavioural checks. It can add friction and visibility, but it cannot be relied on as the sole prevention layer in adversarial conditions.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Intent Collision: Intent collision occurs when an agent merges legitimate user intent with attacker-controlled instructions into one execution plan. The resulting action sequence may look coherent to the model, but it is actually the product of mixed trust sources and therefore unsafe to treat as a valid task.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.