Models do not separate code from data, so a rule in the prompt can be argued with by an email

In a computer the instructions and the data they operate on are kept apart, and most of the worst security bugs in history, from buffer overflows to SQL injection, are what happens when that separation breaks; in a language model there is no separation to break, every instruction and every piece of content arrives in the same channel, and the UK's National Cyber Security Centre said in December 2025 that prompt injection may never be mitigated the way SQL injection was. A behaviour policy does not fix this; it moves the most important instructions, what the agent may do, into a channel the content cannot reach, loaded by the platform, versioned, signed and checked outside the model where it can be.

Decided by. Nobody yet: a candidate for Dinis to read, comment on and decide (keep, rewrite, merge, cut, article first, later, not doing it).

Note. Sits beside secrets-never-in-the-chat (the lethal trifecta) and is the reason mandate-reach-gap calls a rule in a prompt hope. Quote worth keeping, Simon Willison's: 'LLMs follow instructions in content'.

Where it comes from

A policy beside the prompt The old problem: code and data in one channel; What this does not claim (newsroom)

What it answers in the 2018 book

Strings should be banned unanswered outline, Security
Pointers unanswered outline, Security

Where it goes

Chapter Controlling your agent: RiskMandate, part Build it without a server (drafting); topic Security for the agent era: least code, supply chain, secrets, learning to hack.

Other ideas proposed for the same chapter: Mandate, reach and the gap: hope versus enforcement, Code is a liability; the future is the smallest code that does the job, Learning to hack is still how you learn how things work: draw the line where the attacker is, The secret goes from the drop into the tool, never into the chat, Security experience is what lets you ship with known gaps: list them, match them to the reader, say what would change the call, The agent behaviour policy is the due diligence document: a buyer reads the blast radius off it, and its absence says the most, A vault per conversation and per job: a leaked key exposes one small thing, not an inbox, The desktop is the barrier, not the model: prompt injection is not solved, so the box has to hold, Reach is a computed value, and new capability lands as excess, never as new authority, Who can pull the plug: an agent that cannot be stopped is riskier than one that can, A third input: a behaviour policy beside the system prompt and the prompt, which the vendor acknowledges, enforces where it can and answers for, Aviation and payments got safe when the rule, the liability and the business model pointed the same way, Zoom into an agent's behaviour policy and you find the business logic, which only the business can write, Software was the law: the rule the screen enforced by omission is no longer enforced once an agent calls the API, Every rule lands in one of three states: backed by a control, governed by an accepted risk, or resting on hope, Write down what your agent can reach in twenty minutes: list its tools, say what you wanted it for, write the gap.

Node idea:code-and-data-in-one-channel in graph.json; see it in the graph. Source: admin/content/graph/ideas.json.