Skip to content
Flows
Guard Memory Writes Against Injection
Agent QA & Security90-120 minutes
0/4 steps0%

Step 1 of 4

Make writes source-aware

Where a memory came from determines what it may become.

Prompt capsule

Instrument the memory write path with source awareness. Every write must carry the provenance of the content it derived from: USER-STATED (the user directly told the agent), OBSERVED (the agent verified via its own tool execution - a test passed, a file exists), UNTRUSTED-DERIVED (extracted from web pages, third-party docs, tool results of external origin), or INFERRED (the model's own reasoning). Policy by source: user-stated and observed may write to the normal store; untrusted-derived and low-confidence inferred route to quarantine (next step); nothing writes to a 'high-trust' tier except user-stated or multiply-observed. Refactor the memory tool so the source tag is required, not optional, and reject writes that cannot name their source.

Paste into Claude · Complete implementation prompt with explicit requirements

Expected after this step

A source-required write path enforcing policy by provenance.

Should not happen

  • Persisting anything the agent 'learned' without asking where it came from
  • Memories with no provenance, so a poisoned fact is indistinguishable from a real one
  • Untrusted-sourced claims recalled with full authority
  • Never re-checking stored facts, so poison persists indefinitely

Verify before continuing

Do not move on until every check is true. The complete button stays locked until then.

Do not continue if…

  • !Persisting anything the agent 'learned' without asking where it came from
  • !Memories with no provenance, so a poisoned fact is indistinguishable from a real one
  • !Untrusted-sourced claims recalled with full authority
  • !Never re-checking stored facts, so poison persists indefinitely

If the AI messes this up

Use this when the AI fakes progress or breaks the feature. It forces a real fix.

Writes arrive without a credible source. The model is guessing sources to satisfy the field - tighten instructions and validation: 'observed' requires citing the tool result that proves it, or it is demoted to inferred.

Your notes for this step