Authenticated Authority Channel

Tool-using agents often place operator instructions, standing policy, retrieved documents, webpages, messages, tool output, summaries, and delegated reports in the same model context. Untrusted content can then contain imperative language that resembles a legitimate command. If the runtime does not preserve where each instruction-like statement came from, source content can be mistaken for authorization, persisted as policy, or used to redirect a consequential action.

This is broader than deciding whether a passage is malicious. A benign document can describe a real procedure without authorizing the agent to perform it. The missing distinction is between information that may influence reasoning and input that may grant authority.

Maintain a distinguishable authority channel throughout the workflow:

• Control state contains authenticated current operator intent, explicitly adopted standing policy, and runtime-enforced permissions.
• Attributed content contains external sources, retrieved files, messages under analysis, tool output, model-generated summaries, and delegated reports.
• Attributed content may supply facts and candidate parameters, but it cannot expand scope, grant permission, alter persistent policy, or authorize execution.
• A privileged execution point independently validates the proposed operation, target, destination, authority, and arguments against control state before acting.
• Summarization, compaction, delegation, and persistence must preserve the distinction. If provenance is lost, downgrade to read-only work or request fresh authenticated approval before consequential execution.

control = load_authenticated_intent_and_policy()
content = retrieve_with_provenance()
proposal = reason_over(control.task, content)

if proposal.exceeds(control.authority):
    request_authenticated_approval(proposal)
else:
    executor.validate_and_run(proposal, control, content.provenance)

Labels and prompt delimiters can help the model interpret context, but they are not security boundaries. Back the pattern with scoped credentials, capability controls, egress restrictions, deterministic validation, or isolation proportionate to the downside.

This pattern complements narrower controls in the catalog. Action Selector removes untrusted feedback from a finite control loop; Policy-Gated Tool Proxy and Sandboxed Tool Authorization enforce permissions at the tool boundary; Context Minimization removes tainted material when it is no longer needed; and the Lethal Trifecta reduces dangerous capability combinations. Authenticated Authority Channel instead preserves the authority-versus-content distinction end to end when untrusted material must remain available through retrieval, summarization, compaction, delegation, persistence, and execution.

1. Define which authenticated channel can supply current operator intent. Do not infer authority merely from access to a file, inbox, repository, or tool result.
2. Attach source type and provenance before external material enters model context. Preserve those labels in summaries and handoffs.
3. Keep retrieved imperatives attributed to their source. Do not automatically promote them into memory, recurring jobs, configuration, policy, or identity.
4. Derive candidate actions from the authenticated task while treating source content as evidence and proposed parameters.
5. At execution time, validate the operation, recipient or target, destination, arguments, scope, and effective permissions independently of free-form source text.
6. If the runtime cannot reconstruct the authority boundary after compaction or delegation, stop consequential execution, continue read-only analysis, or obtain fresh approval.
7. Test with matched cases: benign content, a legitimate task-relevant procedure, and an adversarial variant that claims approval or redirects a consequential argument.

• Pros: Reduces accidental authority laundering; supports flexible reasoning over untrusted content; creates a clear enforcement and audit point; applies where a strict finite action selector is impractical.
• Cons: Requires authenticated intent, provenance-aware context construction, and an independent execution check; labels consume context and may be lost by unsupported runtimes; approval fallbacks can add friction.
• Limit: Provenance establishes attribution, not authenticity or authorization. Control state can be stale, compromised, or bound to the wrong principal. This pattern reduces authority laundering; it does not make an LLM trustworthy, sanitize malicious data, prove source authenticity, or replace technical isolation.

• OWASP LLM Prompt Injection Prevention Cheat Sheet
• Debenedetti et al., Defeating Prompt Injections by Design — control/data-flow separation and capability enforcement in CaMeL.
• Beurer-Kellner et al., Design Patterns for Securing LLM Agents against Prompt Injections
• Bobert Agent Template — Untrusted-content execution boundary — author-maintained documented reference design, not evidence of runtime enforcement.