Let Research Agents Act Without Trusting Everything They Read
Keep action authority deterministic when an agent reads web pages, messages, retrieved documents, or other agent outputs that may be wrong or adversarial.
What this path changes
Compromised or misleading context can inform a proposal without inheriting authority to execute commands, send messages, create accounts, or purchase services.
The action, boundary, and evidence
Who owns the risk
AI engineers, autonomous-agent builders, and security architects responsible for research agents and multi-agent workflows.
When the gate runs
An agent consumes a web page, retrieved document, message, or another agent's output and then proposes an external action.
How to configure assurance
Use deterministic 5D policy as the action authority. Jev, another LLM observer, or both may add semantic risk signals. Disagreement or missing required evidence follows the configured fail-closed path.
- Run a command copied from a web page or retrieved document.
- Install software, send a message, or create an external account.
- Purchase a service or delegate a privileged action to another agent.
- Prompt-injection-to-action scenarios and compromised-context tests that assert the side effect never runs on block.
- Multi-agent handoff examples, observer-disagreement behavior, and an action-level decision trail.
Next: Run the untrusted-context example with demonstration tools and no external side effects.
Follow a matching proposed action through the gate.
Synthetic tested action under the pinned 5D 0.7.0 illustrative policy.
Execute a helper script referenced by retrieved content
A malicious source turns research into privileged local code execution. Under the pinned illustrative policy, the expected result is that the action is ineligible for execution.
- Tool
- shell.execute
- Target
- developer workstation
- Purpose
- process research artifact
5D suppliesA deterministic RED block at the shell boundary.
Host ownsSandboxing, provenance checks, and interception of every executor.
Coverage limit5D does not analyze arbitrary program behavior.
Where this control fits in the governance lifecycle.
These references identify possible technical-evidence contributions. They do not mean every framework applies to every deployment.
This mapping identifies possible technical-evidence contributions. It is not legal advice, certification, conformity assessment, readiness scoring, a compliance conclusion, or proof that an AI deployment is safe. Applicability, governance, integration coverage, and deployment outcomes remain the organisation's responsibility.
Test
Does the policy behave as intended?
ASI01 Agent Goal Hijack — mitigation 8; ASI02 Tool Misuse and Exploitation — mitigations 1–4Red-team scenarios and bounded tool-use controls
What 5D helps with: Hostile scenarios can test one technical measure: pre-action policy on covered tool calls.
What 5D does not establish: 5D does not mitigate either complete ASI risk; effectiveness depends on realistic scenarios, complete interception and host enforcement.
Official source ↗Enforce at action time
May this proposed action cross the boundary?
Dimensions 1 and 3 — Bound risks; implement technical controls and processesBound action space and enforce technical controls
What 5D helps with: 5D can apply deterministic policy before a covered external action.
What 5D does not establish: The host owns correct context, complete interception, downstream enforcement and the decision that the policy is sufficient.
Official source ↗Observe and review
What happened, and can the decision be reconstructed and challenged?
Articles 12(1)–(2), 14 and 26(2), 26(5)Record-keeping, human oversight and deployer monitoring
What 5D helps with: Action receipts and a human-review route can contribute selected technical evidence for a covered path.
What 5D does not establish: Article 26 applies to deployers of applicable high-risk AI systems. 5D does not determine role or applicability, nor establish required log scope, completeness, custody, retention or oversight sufficiency.
Official source ↗MAP 3.5; MEASURE 2.4 and 3.1; MANAGE 4.1Human oversight, measurement documentation and post-deployment monitoring
What 5D helps with: Separate policy, review and outcome states can contribute action-level evidence to oversight and monitoring.
What 5D does not establish: 5D does not establish organisation-wide monitoring, assessor independence, reviewer sufficiency or incident response.
Official source ↗Inspect the resulting decision trail
from fivedrisk.logger import DecisionLog
log = DecisionLog()
for row in log.query_recent(limit=5):
print(row["band"], row["tool_name"], row["rationale"])Written for fivedrisk==0.7.0. Verify against the immutable source and public documentation before use.
Separate source content from action authority
Treat web pages, retrieved documents, messages, and peer-agent outputs as untrusted context. Normalize the proposed side effect separately so copied instructions cannot become permissions.
Compose semantic evidence under policy
Jev or another model may identify contextual risk, inconsistency, or suspicious intent. The deterministic layer applies red lines and decides whether the evidence permits, holds, or blocks the action.
Keep the evidence trail
Record the source references, normalized action, optional observer output, policy version, disposition, and execution status. This makes it possible to reconstruct how untrusted context became a blocked, held, or permitted action.
What this page does not establish
- 5D does not make retrieved content trustworthy or prevent every prompt injection; it constrains the resulting action path.
- Coverage depends on routing every relevant action path through the gate, including delegated and alternate tools.
- A decision record is evidence, not proof that the policy, source content, or outcome was appropriate.