.tip

An agent can't tell the user's instruction apart from one hidden in a GitHub issue it just read, but your code can. Mark every tool result with where it came from, and refuse to auto-approve a write once untrusted text is in the context.

if (call.provenance.includes("untrusted") && WRITES.has(call.name)) return "ask";

This is taint tracking, which Perl had in 1989, and it works on agents too.