The agent lied. The gate didn't care.

2026-07-21 · 1 min read

AI models are fundamentally prone to prompt injection. No matter how much system-prompting you apply, an attacker can and will find a way to manipulate the agent into doing something you didn't authorize.

This leads to a simple, unavoidable conclusion: you must assume breach.

If you assume the agent will be compromised, how do you protect your enterprise data? You do it by ensuring that the enforcement mechanism lives outside the model. It must be deterministic, and it must operate at the action layer.

Consider the canonical injection scenario. A compromised agent attempts to exfiltrate sensitive data via a Slack tool call, and its internal reasoning (the "scratchpad") is manipulated so it claims it is sending a harmless notification. It lies.

This is exactly the case Praxom, our control plane, is built for. Praxom does not care what the agent says it is doing. It intercepts the raw MCP tool call, evaluates the payload against deterministic SHACL constraints and JSON predicates, and — when the taint-flow rules match — denies the action. The enforcement does not rely on the agent's self-report; it relies on the confirmed state of the action.

(Illustrative scenario, not an account of a specific customer incident.)

That is the whole design: put the deciding authority outside the model, make it deterministic, and evaluate the action — not the story the agent tells about it.