Security & Guardrails

Prompt injection, least privilege, sandboxing, and the guardrail catalog

• The Agent Threat Model — The map of how agents get attacked: one token stream that cannot tell instructions from data, an agent that turns that confusion into actions, the lethal trifecta that makes it exfiltration, and the OWASP taxonomies that name the rest. (5 lessons, 45 min)
• Prompt Injection: The Vulnerability With No Patch — Instructions and data share one channel by construction, so an agent cannot reliably tell your orders from an attacker’s. Direct injection, indirect injection, and tool-output poisoning — and why containment, not detection, is the strategy that holds. (5 lessons, 45 min)
• Tool Scoping and Least Privilege: Making the Dangerous Thing Impossible — Containment, part one — the permission surface. Because the model can be talked into anything, the runtime has to make the dangerous action impossible: read-only defaults, parameter constraints enforced in code, scoped short-lived credentials, egress allowlists in infrastructure, and gates that bind to exact parameters. (5 lessons, 45 min)
• Sandboxing and Computer Use: Isolation for What You Cannot Pre-Approve — Containment, part two. Scoping tools handles the calls you can enumerate; sandboxing handles the ones you cannot — agent-written code, shell commands, and browsers pointed at the open web. The isolation ladder, sandbox hygiene, and the containment rules for computer use. (5 lessons, 45 min)
• Agent Identity, Auth, and Secrets — Two questions decide every agent authorization design: what may THE AGENT do, and on WHOSE BEHALF is it acting? Per-agent identity, on-behalf-of delegation, short-lived task-scoped credentials, secrets that never touch the context window, and audit trails that survive an incident. (5 lessons, 45 min)
• The Guardrail Catalog: Runtime Checks, Mapped Per Cloud — Guardrails are runtime checks that live outside the model — input filters, output classifiers, tool-call validators, PII redaction, grounding checks. Build them as a reusable catalog (risk → check → placement → cost), map each entry onto Bedrock, Foundry and Gemini Agent Platform, and learn why a catalog without containment is theatre. (5 lessons, 45 min)
• Supply Chain and MCP Security: Code You Run, Content You Trust — Every tool integration you install is two attack surfaces at once — a process running with your credentials and a writing channel into your model’s context. The attack taxonomy, the disclosed incidents, the review that catches them, and the allowlist process that scales it. (5 lessons, 45 min)