Why AI Agent Guardrail Prompts Fail Under Prompt Injection — And How Pre-Deterministic ACP Truth Tables Fix It

Описание и применение

Система защиты агента от подмены инструкций через инъекции заменяет модельный вывод на детерминированный шлюз, который проверяет действия по таблице истинности и возвращает ALLOW, HOLD или DENY.

Задача

Guardrail prompts can be overridden by prompt injection, allowing attackers to bypass agent safeguards such as "never wire money without approval."

Результат

By moving decision logic out of the model into a deterministic gate, the system prevents prompt injection from influencing guardrail outcomes, ensuring consistent ALLOW/HOLD/DENY decisions and enabling human review when necessary.

Рабочий процесс

• 1. Agent proposes an action.
• 2. The action is passed to the acp_engine.py deterministic gate.
• 3. The gate evaluates the action against a pre-deterministic truth table.
• 4. The gate returns ALLOW, HOLD, or DENY.
• 5. If HOLD, the action is routed to a human with an HMAC‑SHA256 token for approval.
• 6. If ALLOW or DENY, the action proceeds or is blocked accordingly.

Доказательства

Guardrail prompts are advice, and advice is exactly what a prompt injection overwrites.

Источник

Protocol One's acp_engine.py (v3.1.0) is a zero‑dependency Python engine that does this.

Источник

It evaluates a proposed agent action against a pre‑deterministic truth table and returns exactly one of three outcomes: ALLOW, HOLD, or DENY.

Источник

Because both tools are plain Python files with no dependencies, you can read them in one sitting, audit them, and run them in CI before an agent is allowed to touch production systems.

Источник