Definition
Principle (Beurer-Kellner et al., 2025): once an agent has ingested untrusted input, it must be impossible for that input to trigger a consequential action.
Patterns: Action-Selector, Plan-Then-Execute, LLM Map-Reduce, Dual LLM, Code-Then-Execute, Context-Minimization.
CaMeL (Debenedetti et al., 2025): a privileged LLM writes a fixed program from the trusted query; a quarantined LLM parses untrusted data into values without tool access; an interpreter tracks capabilities (sources, allowed readers) and checks every tool call against a policy. Provable against injected actions and unauthorized data flows (77% vs. 84% AgentDojo utility), but not against text-to-text manipulation or side channels, and it needs a plan fixed in advance, which open-ended agents donβt have.