The Prompt Is Not a Perimeter
Telling an agent what it should not do is different from making the prohibited action impossible.
Scenario
A school uses an AI agent to summarize documents. The requirement is: Never send private student data outside the school.
Activity
Classify each proposed control as an instruction, preventive control, approval control, or evidence/detection control:
- A system prompt that says not to send private data.
- A credential that can read only one approved folder.
- An outbound network allowlist.
- A tool allowlist.
- Human approval before an external write.
- Structured output that rejects unexpected fields.
- Audit logs of tool and network activity.
- A short-lived task-specific credential.
Then answer: Which controls actually reduce what the agent is capable of doing?
Deliverable
Draw a simple boundary diagram showing the model, tools, credentials, filesystem/data source, network, approval point, and logs.
Discussion
Why can a prompt still be useful even though it is not an access-control boundary?
Source material
First spotted in PTIR: August 6, 2026, Morning Briefing.
Cloudflare’s Agent Access Model proposes task-bound, short-lived credentials; enforcement in the agent harness and network instead of prompts; selective approval for consequential actions; evidence-backed grant review; and a one-way reduction of capabilities as sensitive data enters the workflow. The lab turns those architecture ideas into a simple classification exercise about which controls express intent and which actually bound capability.