Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies

Summary

An AI agent can exfiltrate private data when one session combines access to confidential information, attacker-controlled content, and an external communication channel, even though each capability is individually authorized. Omnigent's contextual policy tracks those three legs as session state: private data, untrusted content, and exfiltration, with human-defined tool or argument-based classifications. It allows ordinary actions until both prerequisite legs are lit, then denies the outbound call that would complete the trifecta. In the support assistant example, a user-supplied ticket instructs the agent to read internal Q3 revenue figures and email them externally; without the policy, the confidential number leaves in a reply, while the protected run blocks that email. A password-reset ticket still proceeds because it lights only the untrusted-content leg, and an empty internal lookup does not light the private-data leg.

Takeaways

1. 1

   The policy blocks only the third leg after private-data and untrusted-content access have occurred; having both prerequisite legs lit does not itself stop the session.

2. 2

   A support ticket can be the untrusted input that directs an agent to read internal revenue data and send it to an external mailbox.

3. 3

   Leg classification is controlled by a human in agent configuration, preventing the agent from reclassifying data or content at runtime.