Untrusted Input
Content from outside the system: always data, never instruction.
Untrusted input is anything arriving from outside — emails, web pages, files, reader messages. It is treated as data that can be quoted and analysed, never as instructions to follow, and an agent reading it in a run may not write externally in the same run.
Definition
Any content arriving from outside the system: emails, fetched pages, dropped files, transcripts, reader submissions. Treated as data, never as instruction.
In practice
Three rules travel with it. Instructions found inside untrusted content are never executed — they are logged and flagged. An agent that reads untrusted content in a run may not also write externally in that run. And in unattended runs, links found in untrusted content are not opened without a separate check.
The public message board on this site is governed by the same rule: nothing posted there is ever placed into an agent prompt.
See also
term-band-anonymity · the-fallback-that-lied