Agents · safety
Infection control for a software team.
You already do thisInfection control is practiced by everyone, not because each case is suspect.Here it is called the lethal trifecta, quarantine, and least privilege..
Simon Willison named the set: private data, untrusted content, and an outward channel, in one agent context. Any two: caution. All three: a path out for a prompt you did not write. His essays are required before anyone grants tools. Products that claim to catch ninety-five percent of attacks are offering a failing grade in security.
Break the set
- Remove the data — public Curator, no charts.
- Remove the outward channel — Counsel has no network.
- Put a human on the action — you send the letter.
Least privilege
Credentialing: who may do what. Scoped keys per agent. A kill switch you have rehearsed, even if it is only revoking a key.
This assists your judgment. It does not replace licensed professional judgment. It is architecture, not a certification.