Keep untrusted content behind the action boundary

Protect the point where retrieved text, messages or tool responses could influence an agent's decisions and actions.

Protect the boundary between information and action in AI-enabled work. Connect untrusted inputs to explicit permissions, verification and human accountability.

Separate information from authority

An agent may consume documents, tickets, messages and tool responses while deciding what to do next. Those materials can contain instruction-like text. An authorised repository can still hold outdated, conflicting or malicious content, so its location does not make every statement an approved instruction.

AIDIVE treats this as an operating boundary. Retrieved material may provide evidence for a decision; it must not silently alter the agent's purpose, permissions, workflow or approval requirements. The organisation remains responsible for defining who can authorise action.

Test the complete route to action

Inspect the path from incoming content through reasoning, tool selection and execution. Define permitted operations and their constraints, preserve the identity and delegation chain behind material actions, and make blocked actions or escalation visible in operational evidence.

Control effectiveness requires more than a model filter or a policy statement. Test representative content, permission boundaries and attempts to redirect work. Retain enough context to reconstruct what was read, what authority applied, what action occurred and whether a person intervened. Reassess when tools, permissions or operating conditions change.

Illustrative example: a supplier attachment

An agent checking an invoice encounters an attachment telling it to bypass normal approval and update payment details. The attachment is input evidence, not a source of delegated authority. The action boundary should prevent the requested change and route the exception through the approved owner.

A useful test covers both the immediate action and its aftermath: was the attempt recorded, did any unauthorised state change occur, can the case be reconstructed, and does the response improve the control? Include ambiguous and apparently routine cases as well as obvious attacks.

• Identify which sources may issue instructions and which supply evidence.
• Constrain tool use through identity, permissions and explicit action contracts.
• Exercise blocking, escalation, intervention and recovery under realistic conditions.

Take this into your next conversation.

Trust in a source affects how evidence is assessed. It does not grant that source authority to change an agent's instructions or permissions.

Framework source

Editorial adaptation from the supplied AIDIVE Version 1 master documents.

• AIDIVE Integration Dimension Version-1.docx · I.2.4 Untrusted Input and the Action Boundary; I.5.2 Tool and Capability Contracts; I.5.3 Machine Identity, Delegation Chain and Action Authorization
• AIDIVE Integration - Practices & Playbook Version-1.docx · AR-I07 Untrusted Input and Action Boundary Test
• AIDIVE Data Dimension Version-1.docx · Guidance for Assessors; D.5 Data Trust, Risk & Continuous Improvement
• AIDIVE Ethics Dimension Version-1.docx · E.5.2 Agent identity, credentials and least privilege; E.5.3 Tool, data, memory and environment boundaries

Go a little deeper.

Put AI transformation
into practice.

Build capability through training, contribute your expertise or explore a connected workspace for applying the holistic AIDIVE framework.

Build the capability.

Develop the skills to connect AI transformation strategy, business outcomes, people and governance to your own decisions and responsibilities.

Grow the practice.

Bring your learning, delivery or research expertise to the holistic AIDIVE approach to enterprise AI transformation.

Bring AIDIVE into your work.

See how the proposed workspace could connect AI transformation learning, maturity evidence and practical artifacts.