Part

Security boundary

You might say: trust boundary, agent containment, blast-radius control

The set of gates around a run that separate trusted factory services from task input, tools, data, and side effects. It combines isolation, identity, least privilege, and outbound controls.

What it does

Limits what hostile text or a compromised task can read, change, or transmit.

Ask

If the task follows an attacker instruction, which layer stops the next harmful action?

Typical

Use several independent gates: disposable environment, egress policy, scoped secrets, least-privilege identity, and human approval for high-risk actions.

Trouble

A ticket or PR can steer a run into private data, a powerful token, and an external channel in one path.

What to look for

1. Isolation, token-scope and network settings in the runner configuration
2. Separate permission scopes for read, write, and publish actions
3. Blocked actions and approval gates on the run page

Parts

• Prompt injection: An attacker places instructions in a ticket, PR, document, web page, or tool result that the model may treat as factory instructions.
• Least privilege: The smallest set of identities, API scopes, files, and actions a run needs to finish its task.

Pattern

Defense in depth

Connections

• See also: Network egress
• See also: Secrets
• See also: Bot identity

Sources

1. Simon Willison, The lethal trifecta for AI agents: private data, untrusted content, and external communication, The lethal trifectaIf your agent combines these three features, an attacker can **easily trick it** into accessing your private data and sending it to that attacker.
2. OWASP GenAI Security Project, LLM01:2025 Prompt Injection, Prevention and Mitigation StrategiesRestrict the model’s access privileges to the minimum necessary for its intended operations.
3. OWASP GenAI Security Project, LLM01:2025 Prompt Injection, Prevention and Mitigation StrategiesImplement human-in-the-loop controls for privileged operations to prevent unauthorized actions.
4. Heather Adkins et al., Building Secure and Reliable Systems, Design for ResilienceWhen you use compartmentalization, however, a security breach or traffic overload in one compartment does not jeopardize all of the compartments.
5. Matt Pocock, AI Coding Dictionary, SandboxLimits the blast radius of agent actions
6. Matt Pocock, AI Coding Dictionary, SandboxThe safety substrate that makes AFK practical.

Use it on your project

teardown-apply: hold "Security boundary" (security-boundary) from the teardown at https://teardownatlas.com/software-factory/ against my project

Paste it into a coding agent that has the teardown skills.

An AI agent wrote this map with the teardown skill. It can contain errors: check the sources before you rely on a part. About and legal