Agents that stay safe by design

What you'll learn

An agent reads text that anyone could have written, holds data that should stay private, and can act on the world. This site is about the defences: where the trust boundaries are, how to label every value by where it came from and how secret it is, why a model cannot be trusted to tell data from instructions, the three capabilities that must never meet, least privilege and audience-bound tokens, the sandbox around a tool's process, why detectors never reach zero, designs that make safety structural, approvals that stay worth reading, and what every defence costs. Threats appear only as the categories their papers name; there are no attack recipes here.

The animations are driven by Agent_Loop_Sim's policy module, identically in Python and in your browser: a policy engine over abstract labels, never content. Over all 256 subsets of its 8 tools, the trifecta check agrees with an exhaustive search for a way out on 256. On a suite of 120 benign tasks, planning in advance with least privilege finishes 76.7% of them and leaves a steered attempt 2.4% of tasks against an adaptive attacker, where no defence leaves 42.9%. No language model runs anywhere.