Advait Patel, speaking at QCon AI Boston, says prompts are not a security boundary and the tool layer is where the damage can be limited. He recommends a separate identity for each agent and session, short-lived task-scoped tokens, and a policy engine between agent intent and execution. Destructive actions should fail closed, with approvals for high-impact ones and a kill switch tested before an incident. His demo shows a poisoned document being stopped by sanitising and policy checks. He also notes the cost in latency and a possible single point of failure.
