Topic starter
22/07/2026 4:38 pm
TL;DR: A new survey on isolation in LLM-agent systems argues that the recurring failures behind prompt injection, tool misuse, memory poisoning, and unsafe execution all trace back to broken boundaries, and that enforcement must sit outside the model, according to Pomerium's analysis of the research. The core issue is that probabilistic guardrails cannot substitute for structural control when agents can turn text into action.
Editorial analysis by NHI Mgmt Group, based on content published by Pomerium: “Agents Have Boundary Issues. Your Infrastructure Shouldn't.”.
Key questions
Q: How should security teams set access boundaries for AI agents?
A: Security teams should define agent boundaries around data sources, tools, and allowed actions before any production rollout.
Q: Why do prompt filters fail to stop risky agent behaviour?
A: Prompt filters only inspect text, but risky agent behaviour appears when that text becomes an API call, shell command, or other executable action.
Q: What breaks when an AI agent is allowed to call tools without strict scope controls?
A: The main failure is privilege expansion.
Practitioner guidance
- Enforce policy outside the model Place an identity-aware gateway or policy engine in front of MCP servers, APIs, and internal apps so the agent’s request is evaluated before any side effect occurs.
- Scope every tool call explicitly Limit each agent to named tools, named destinations, and named actions so capability scope is visible and machine-enforced rather than inferred from prompt text.
- Terminate and reissue credentials per request Use short-lived, scoped tokens for each action path so the agent never carries standing authority across unrelated tasks or sessions.
Bottom line: AI agent safety breaks down when boundaries are enforced by prompts instead of infrastructure, because the model can still be persuaded to attempt unsafe actions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/07/2026 4:42 pm
Isolation by construction is the right control model for AI agents. The article’s real contribution is not a new prompt defense, but the argument that security fails when the system trusts the model to remain bounded. Once a model can influence tools, execution, or peers, the only durable control is structural enforcement outside the model. That is the point practitioners should carry into zero trust and NHI governance.
A question worth separating out:
Q: How should teams govern cross-session delegation between AI agents?
A: Treat session-to-session messaging as a delegated access path and require explicit ownership, scope, and approval rules before one agent can act on another’s blocked or denied request. Without that boundary, an agent can launder authority across sessions even when no single user intended the outcome. The governance problem is delegation, not only execution.
👉 Read our full editorial: AI agent boundary enforcement belongs outside the model