The agent was persuaded. What is it authorised to do next?

Prompt injection defences fail sometimes. Scope decides what happens then. Four permission questions that bound the damage when the model is convinced.

Design control EUGlobal

In short

  • Prompt injection has sat at LLM01, the top entry of the OWASP list for generative AI, since the 2025 edition. No control removes it, so the design question is what follows a successful one.
  • Anthropic's September 2026 report describes agents running unattended for hours or days. Any authorisation granted to that agent is exercised at that speed.
  • Scope, not detection, is the control that degrades gracefully. A detector that is 99% effective still fails on the 1%, and the blast radius on that attempt is set entirely by permissions.
  • Article 14 of the AI Act requires human oversight for high-risk systems to be effective, which for an autonomous agent means an approval gate on the specific actions that cannot be undone.
  • Four questions bound the damage: what can it read, what can it write, who can it act as, and what cannot be reversed.
Advertisement

What do AI assistants say about your organisation?

Model answers are becoming a channel your communications team does not control. EntityRise audits how assistants describe your company and whose name they give instead. From $19.

Audit your AI visibility at EntityRise.ai →

Every discussion of prompt injection eventually reaches the same place: the defences help, and sometimes they fail.

The useful question is the one that starts after that. When the model has been convinced, what is it actually able to do?

01Why is scope the control that survives failure?

Because detection has a failure rate and scope does not.

Prompt injection has been the top entry on the OWASP list for generative AI applications since the 2025 edition, and it has stayed there because it is not a defect to be patched. Instructions and data arrive through the same channel. Every mitigation published so far lowers the success rate rather than closing the class.

A filter that stops 99 attempts in 100 is a good filter. On the hundredth, the only thing standing between the attacker and the outcome is what the agent was authorised to do. That authorisation was set months earlier, usually by whoever wanted the integration to work on the first try.

02How fast does an over-scoped agent do damage?

Faster than a review cycle, which is the point of the September 2026 threat reporting.

Anthropic’s September 2026 threat intelligence report describes multi-agent frameworks conducting reconnaissance, exploitation and theft for hours or days at a time with minimal human oversight. Defenders read those numbers as a description of attacker capability. They are also a description of your own agents, which run on the same substrate at the same speed.

An agent with delete permission on a bucket does not delete one object. It completes the task it was persuaded to accept, and it does so before the next standup.

03What four questions bound the damage?

Framework prepared by The Guardrail. Editorial judgement drawn from ordinary least privilege practice, not from a published standard.
QuestionWeak answerBounded answer
What can it read?Whatever the service account seesAn explicit set of sources, logged per call
What can it write?Same scope as read1 destination, append only where possible
Who does it act as?A shared service identityIts own identity, distinguishable in every audit trail
What cannot be reversed?Not enumeratedA named list behind an approval gate

The third row is the one teams skip, and it is the one that decides whether an incident can be investigated at all. An agent that acts as a shared service account leaves a trail indistinguishable from the humans and jobs sharing that account, which turns a two hour forensic question into a two week one. What to record is the other half of this control.

04Where should the approval gate sit?

On irreversibility, not on sensitivity.

Gating suggestion prepared by The Guardrail, using irreversibility as the criterion. Counts are illustrative of typical deployments, not measurements.
Action classReversibleSuggested gate
Read, summarise, draftYesNone, log only
Write to an internal storeUsually, with versioningRate limit, 1 destination
Send external messageNoHuman approval
Payment, deletion, permission changeNoHuman approval, 2 party where material

Article 14 of the AI Act requires that human oversight of a high-risk system be effective. An approval prompt that a person clicks forty times a day is not effective oversight, it is a keystroke. Gating only the irreversible actions keeps the number of decisions low enough that each one is still a decision.

05Which obligations does this map onto?

Provisions read from the operative text of Regulation (EU) 2024/1689, with application dates as amended in June 2026. OWASP ranking as published.
RequirementProvisionApplies from
Automatic recording of events over the lifetimeArticle 122 Dec 2027
Human oversight that is effective in practiceArticle 142 Dec 2027
Resilience against attempts to exploit vulnerabilitiesArticle 152 Dec 2027
Prompt injection ranked as the leading riskOWASP LLM012025 edition

Those dates are the Annex III high-risk dates after the June 2026 deferral. For anything embedded in an Annex I regulated product, read 2 August 2028 instead.

06What does this look like in a change request?

Three lines, and they are boring on purpose.

The agent gets its own identity rather than sharing one. Its write scope is narrower than its read scope, and the difference is written down. The irreversible actions are listed by name, and each is behind an approval that a named person owns.

None of that stops prompt injection. It changes the worst outcome from an incident that requires disclosure into one that requires a rollback, and that difference is the whole argument.

07Frequently asked questions

Can prompt injection be fixed?

Not eliminated. It remains the top entry on the OWASP list for generative AI applications, and every published mitigation reduces the rate rather than closing the class. Treat it as a control that fails sometimes and design for what happens then.

What is the single most valuable permission control for an agent?

Separating read scope from write scope. Most agent value comes from reading widely, and most agent damage comes from writing, so an agent that reads broadly and writes narrowly keeps the usefulness and removes most of the exposure.

Should a human approve every agent action?

No, because an approval that happens hundreds of times a day becomes a reflex and stops being oversight. Gate the actions that cannot be reversed, such as payments, deletions, external messages and permission changes, and let the rest run.

Does the AI Act require any of this?

For high-risk systems, yes in substance. Article 14 requires human oversight measures that are effective in practice, and Article 15 requires resilience against attempts to exploit vulnerabilities. Neither prescribes scopes, but neither is satisfied by an agent with unrestricted authority.

08References and method

  1. OWASP Top 10 for LLM Applications, 2025 edition, where prompt injection is listed as LLM01. Cited for the ranking and for the treatment of prompt injection as an open class rather than a solved defect.
  2. Anthropic, Countering misuse of AI: September 2026, for the description of multi-agent frameworks operating with minimal human oversight for hours or days at a time.
  3. Regulation (EU) 2024/1689, Article 14 (human oversight) and Article 15 (accuracy, robustness and cybersecurity), for the obligations applying to high-risk AI systems.
  4. The four question framework and the permission comparison are editorial, prepared by The Guardrail. They are not drawn from a published standard.
OC

, Security Editor

Covers agent security and incidents: what an attacker can reach once an AI system holds credentials. Reach them at owen@theguardrailreport.com.