Spending Limits for LangGraph Agents That a Prompt Injection Can't Talk Past

Description and use

<p><strong>Short answer:</strong> a spending limit written into a LangGraph agent's system prompt ("never spend more than $500") is a suggestion, not a control. Any text the agent reads, including a scraped invoice or an email, can contain a competing instruction, and the model has no way to know which one is authoritative. The fix isn't a better prompt. It's moving the check out of the prompt entirely: the agent calls a tool, and something outside the model's control (a server, a policy engine, a <code>pink.request_payment</code> call) decides yes or no before anything happens. Pink Agentic A

Problem

<p><strong>Short answer:</strong> a spending limit written into a LangGraph agent's system prompt ("never spend more than $500") is a suggestion, not a control. Any text the agent reads, including a scraped invoice or an email, can contain a competing instruction, and the model has no way to know which one is authoritative. The fix isn't a better prompt. It's moving the check out of the prompt entirely: the agent calls a tool, and something outside the model's control (a server, a policy engine, a <code>pink.request_payment</code> call) decides yes or no before anything happens. Pink Agentic A

Outcome

<p><strong>Short answer:</strong> a spending limit written into a LangGraph agent's system prompt ("never spend more than $500") is a suggestion, not a control. Any text the agent reads, including a scraped invoice or an email, can contain a competing instruction, and the model has no way to know which one is authoritative. The fix isn't a better prompt. It's moving the check out of the prompt entirely: the agent calls a tool, and something outside the model's control (a server, a policy engine, a <code>pink.request_payment</code> call) decides yes or no before anything happens. Pink Agentic A

Evidence

Spending Limits for LangGraph Agents That a Prompt Injection Can't Talk Past

Source