Guards
4 current practices.
GuardsGD-001Never combine private data, untrusted content and external communicationAn agent with all three at once can be made to exfiltrate your data. Remove any one leg and the attack breaks.
Reviewed Aug 2026GuardsGD-002Quarantine untrusted content instead of telling the model to ignore itPrompt injection is a mixing problem, not a jailbreak. Design so untrusted tokens can't act as instructions.Reviewed Aug 2026GuardsGD-003Sandbox agents to limit blast radiusRun agents with least-privilege access, isolated filesystems and separate worktrees.
Reviewed Aug 2026WatchGuardsGD-004Vet the agent tooling supply chainUntrusted MCP servers and plugins can inject instructions or exfiltrate data. Treat each one as an ingestion point.One source · a little soon to recommend
Reviewed Aug 2026GuardsGD-002Quarantine untrusted content instead of telling the model to ignore itPrompt injection is a mixing problem, not a jailbreak. Design so untrusted tokens can't act as instructions.Reviewed Aug 2026GuardsGD-003Sandbox agents to limit blast radiusRun agents with least-privilege access, isolated filesystems and separate worktrees.Reviewed Aug 2026WatchGuardsGD-004Vet the agent tooling supply chainUntrusted MCP servers and plugins can inject instructions or exfiltrate data. Treat each one as an ingestion point.One source · a little soon to recommend