Make Asking Insufficient: Capability Security for Agents
For a while I answered every new jailbreak by hardening the prompt. That is a game the attacker moves last in. Capability security is how you leave it: make the agent's authority something it holds in a small, fixed amount, not something it can talk its way into.
For a while, every time someone found a new jailbreak, I went and hardened the prompt. A new rule. A firmer instruction. A more careful phrasing to close the hole.
I was losing, and I had agreed to lose. Hardening the prompt is a game where the attacker moves last. They read my latest rule and write the message that steps around it. I patch. They move again. The only way to win a game like that is to stop playing it.
Make asking insufficient
Here is the line I keep coming back to. The agent can ask for anything. It can be tricked into asking for anything. So the job of security is to make asking insufficient.
Not “make the agent ask politely.” Not “teach it which requests to refuse.” Make it so that asking, even asking perfectly, even asking while fully compromised, does not produce the thing. The request is allowed to be hostile. It just has to land against something that does not care how convincing it was.
A capability is authority you hold
The idea that fixed this for me is old, and it has a name: capability-based security. A capability is an unforgeable token of authority. Holding it is permission. Not holding it is the absence of permission, and no amount of asking conjures one into your hand.
Think of a physical key. The key does not weigh your reasons. You do not argue your way through the lock. You hold the key or you do not. A capability is that, for software. Authority you carry, not authority you request and hope is granted.
The three things an agent actually holds
So I stopped asking whether my agent was trustworthy and started asking what it actually holds. For an agent, that turns out to be concrete. Three things.
The service account it runs as. This is the cloud identity the code executes under, and it defines, at the IAM layer, every resource the agent can reach. Not should reach. Can. If the account has no path to another tenant’s data, then no sentence in the prompt, however clever, opens one.
The tools it is handed. Each tool is a door, a narrow validated door that does one defined thing. The agent cannot act outside its tools. Hand it no tool that deletes an account and there is no “delete the account” for a jailbreak to reach, because that capability was never in its hands.
The parameters those tools accept. This is the quiet one. Some parameters the tool validates. Others the harness fills in and the agent never gets to touch. The tenant id is the example I think about most. The agent does not pass “which customer.” The system sets that from the authenticated session, and the tool rejects an override. So the agent cannot even phrase a request for another tenant’s data. The words for it are not in its vocabulary.
Make trust unnecessary
Scope those three tightly and something good happens to the prompt. It gets to be untrusted. I can assume the agent has been fully turned, that every instruction in its context now belongs to the attacker, and the blast radius is still just its small, legitimate set of capabilities. The worst a compromised agent can do is exactly what an honest one can, because that is all it holds.
That is the whole move. I stopped trying to make the model trustworthy and started making trust unnecessary. The agent lives inside walls built from IAM and tool contracts, not inside a paragraph it is asked to respect. Instructions advise. Walls enforce.
Leave the game
There is more to build below this, and it is its own story: the fences that sit under the agent at the data layer, so even a correctly scoped tool cannot be steered into the wrong row. But the mental shift is the part that changed how I build.
You do not win the jailbreak arms race by out-arguing the attacker. You leave it. You make the authority something the agent holds, in a small and fixed amount, instead of something it can talk its way into.