Skip to lesson
Exit
AI & Agent Security Threat Model1 / 2

1 min lesson

A confirmation gate, not a prompt

Walk through the worked example in "A confirmation gate, not a prompt", then explain what it demonstrates.

Step 1 of 2

A confirmation gate, not a prompt. Hard controls live in code the attacker can't edit.ts
const SAFE_TOOLS = new Set(["read_file", "search", "list_dir"]);
const DANGEROUS = new Set(["run_shell", "write_file", "http_request"]);

async function dispatch(call: ToolCall, ctx: AgentContext) {
  if (SAFE_TOOLS.has(call.name)) return run(call);
  if (DANGEROUS.has(call.name)) {
    // Confirmation is enforced in code, regardless of what the model 'decided'.
    const ok = await ctx.confirmWithUser(describe(call));
    if (!ok) return deny(call, "user declined");
    return run(call);
  }
  return deny(call, "tool not allowlisted");
}
Say it like this

"I assume the injection succeeds. My controls don't try to stop the model from being fooled - they make sure a fooled model can't exfiltrate or destroy anything. Privilege separation and a confirmation gate on dangerous actions are hard controls in code; a tightened system prompt is a soft control that only lowers frequency."

Learn more

Optional practice

Practice: a confirmation gate, not a prompt