This is the third of three replies to Suraj Sharma's (@suraj_sharma14) list of agent projects. This one is about who gets to tell an agent what to do. This one is principles only. I'm not publishing specifics, and I'd suggest you don't either.
The rules I build on
The problem is simple. Agents read a lot of text they didn't write: web pages, tool output, other agents' messages. Some of that text can contain instructions. If an agent treats them as orders, anyone who can put text in front of it can steer it.
Here are the rules I build on.
1. Prose is never permission. Ordinary text cannot grant authority, however official it sounds. Not from a web page. Not from a tool. Not from another agent.
2. Outside text is data. Tool results and other agents' messages arrive marked as untrusted. Agents can read them. They don't take orders from them.
3. Authority has a shape. A real approval is a record, not a sentence. It holds the exact question, the option I picked, the time, the scope, and what was excluded. It can be voided. Corrections are added, never written over.
4. Authority is narrow. Merging and deploying need my explicit yes. Spending money needs its own hard yes.
5. No one approves their own work. The agent that designs new agents never ratifies its own designs. A public claim is written by one agent and checked by another, against the exact file that will be posted.
6. Chat is not the ledger. Authority lives in the recorded decision in the repo, and evidence lives in dated receipts. Not in a conversation. Not in an agent's memory. A file on a working machine can be evidence, but it is not a record of authority.
What I'm proposing next: typed handoffs
One schema for one message type, a decision request. It carries an id, the question, the options, the scope, the exclusions and the evidence. Both sides check it. Free text in an authority field is rejected.
Typed fields leave far less room for instructions than free text. So the schema doubles as a first filter between agents.
The proof I'd want before calling it done: the next 10 decision requests pass the check, and one deliberately untyped request gets refused. A merged schema alone won't count.
What I won't publish
How any test was built. What any planted text said. Which accounts or keys exist. A principle helps the next builder. A specific helps an attacker.
What I'd keep from this
- Decide where authority lives before you decide what agents can read.
- Make approval a typed record with scope and exclusions.
- Keep the power to merge, deploy and spend in as few places as possible.
- Separate the writer from the checker, every time.
- Publish the rules. Keep the specifics.
Limits
This describes one builder's rules as of Oct 19, 2026. Typed handoffs are a proposal, not a shipped feature.
Where in your agent stack can plain text still grant permission?
A principle helps the next builder. A specific helps an attacker.