Comment by ezekg

I don't understand how the agent's own authz doesn't match the prompter's authz -- in fact, the agent shouldn't even have its own authz at all! it should always use the prompter's authz, even if that means 'layered' authz (i.e. AND'd) across prompts. Almost all of these prompt-injection attacks crop up because companies decide an agent should be trusted, able to decide its own authz, or that authz for one prompter is the authz of another prompter, which is quite frankly, retarded.