injection containment
Prompt-injection defense
A prompt injection becomes an incident at the moment it reaches a retrieval or a tool call. VisIQ gates both at runtime, so a manipulated agent still cannot read past its clearance or act past its authority, and every attempt leaves a signed record.
Injection is an input, the incident is an action
Injected instructions can arrive in a user message, a retrieved document, or a tool description. As long as the result is only text, the damage is a bad answer. The moment the manipulated agent retrieves restricted material or proposes a tool call, the damage becomes operational.
That is why the durable control sits at execution, where intent turns into effect. There is no remediation for an executed action, so the decision has to happen before it.
The gate does not ask how the model was fooled
Every proposed tool call is evaluated on its own observable facts: which agent, which tool, which arguments, which target. A wire transfer the agent was never authorized to make is denied whether the idea came from a legitimate request or a poisoned document.
Detecting injection attempts is probabilistic by nature; a classifier scores likelihood and will sometimes be wrong in both directions. A policy evaluation of a concrete action is deterministic: the same call gets the same decision, with the matched control recorded.
Retrieved content is the main carrier
Retrieval is where most injected material rides in, and it is governed per document before anything reaches the model's context. Documents carry classification and trust tiers, from public through highly sensitive, and each agent holds an operator-assigned trust tier of its own.
Material outside an agent's business function is redacted or suppressed before the model reads it. A source the agent had no business consulting never gets the chance to steer it.
What this does and does not claim
No external system can inspect or constrain a model's internal reasoning, and claims to the contrary cannot be verified. A manipulated model may still generate off-topic text; that remains a model-quality and prompt-design matter.
What the runtime boundary guarantees is narrower and checkable: injected intent cannot become unauthorized access or unauthorized action without an affirmative decision, and every attempt, permitted or denied, leaves a verifiable record to investigate.