The pattern you chose and why, every tool and its privilege, the attack you most fear, the defenses per risk, and the residual risk you're choosing to accept.
What this is
Choose the architecture, then attack it.
An agent with tools is a bundle of privileges the model will hand to whoever can get text in front of it, including an attacker who hid instructions in a page it reads. This artifact makes the choice and threat-models it. Pairs with Lab 4.
💡 In plain English
Decide the shape, workflow or which agent pattern, then play attacker for ten minutes: for each tool, what is the worst someone could make it do, and what stops them? Mature security also names what you are not fixing, and why that is tolerable.
Do this, in order
Pick, then threat-model.
1
State the architecture you choseWorkflow or agent, the pattern, the tools. One paragraph.
2
List every tool and its privilegeWhat can each do, and the worst an attacker could achieve with it? This single exercise finds most of your real risk.
3
Find your untrusted inputsWhere does external content enter (user text, retrieved docs, tool outputs)? That is where indirect injection lands.
4
Add a defense per riskLeast privilege, allow-lists, human approval on the irreversible ones, I/O guardrails, adversarial tests.
5
Name the residual riskWhat you're accepting and why it's tolerable.
Every dangerous tool has a defense; irreversible actions need approval.
Untrusted content can never directly trigger a high-privilege action.
You can name the worst case and why it's survivable.
✕ Hopeful
"We tell the model not to do bad things."
Injection isn't mentioned; powerful tools, no approvals.
Retrieved text flows straight to a tool call.
Wrapping up
The decision, defended.
One to two pages: the architecture and why, the tool-privilege table, the top threat, the defenses, and the residual risk. Remember: prompt injection is defended in architecture, not wording.
Deliverable
Architecture paragraph + tool table + threat model. Due Sun Aug 9.
submit on Maven
Stuck?
Use the S8 cheat sheet's five defense layers as a checklist against each dangerous tool.
rewatch S7 + S8
For the instructorHow to teach thisclick to open ▾
Push step two hardest: list every tool and the worst an attacker could achieve with it. That exercise alone surfaces most real risk. And insist that untrusted content can never directly fire a high-privilege action, there is always a check in trusted code.
Reward the residual-risk line. Naming what you are choosing not to fix, and why it is tolerable, is the mark of a mature security posture, not a gap. This is defensive work: they are hardening their own agent.