.tip

An agent cannot tell the user's instruction from an instruction hidden in a GitHub issue it just read. Your code can. Mark each tool result with where it came from, and refuse to auto-approve a write once untrusted text is in the context.

if (call.provenance.includes("untrusted") && WRITES.has(call.name)) return "ask";

This is taint tracking. Perl had it in 1989. It works on agents too.