Security model: do not trust the prompt.
An LLM can misunderstand a user or follow a malicious instruction hidden in a document. Quasentra therefore checks authority outside the model, immediately before a supported tool executes.
What Quasentra checks
Workspace, API key and agent identity.
Exact tool action and arguments.
Policy, constraints and approval state.
Allow, deny or pause for review.
Why this helps against prompt injection
permissions = {
"customer.read": "ALLOW",
"customer.delete": "DENY",
}
Even if a hostile prompt convinces the model to request customer.delete, the permission remains DENY. The delete function is not called through the secured path.
Three enforcement levels
| Level | What it means | When to use it |
|---|---|---|
| Intercept | The SDK wraps supported local framework tools. | Normal agent tools and initial integration. |
| Enforce | Trusted Gateway owns the credential and executes a restricted connector. | Business APIs, email and production data. |
| Isolate | A separately configured sandbox also restricts process, network and resources. | Untrusted code or higher-risk workloads. |
How to customize the boundary
- Give every business role its own stable agent ID.
- Expose only the tools that role needs.
- Start new tools denied, then explicitly choose a permission.
- Use approvals for consequential actions.
- Move high-impact credentials to Trusted Gateway.
What Quasentra cannot protect
A local wrapper cannot control a second unwrapped function, a leaked credential, or an unrestricted client that the agent can reach directly. Remove those bypass paths. No product can honestly guarantee that an AI agent is “unhackable”; Quasentra limits what a manipulated agent can execute through its protected boundary.