---
title: "Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies"
description: "An AI agent can exfiltrate private data when one session combines access to confidential information, attacker-controlled content, and an external communication channel, even though each capability is individually authorized. Omnigent's contextual policy tracks those three legs as session state: private data, untrusted content, and exfiltration, with human-defined tool or argument-based classifications. It allows ordinary actions until both prerequisite legs are lit, then denies the outbound call that would complete the trifecta. In the support assistant example, a user-supplied ticket instructs the agent to read internal Q3 revenue figures and email them externally; without the policy, the confidential number leaves in a reply, while the protected run blocks that email. A password-reset ticket still proceeds because it lights only the untrusted-content leg, and an empty internal lookup does not light the private-data leg."
---

# Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies

[Databricks](https://yomu.fyi/company/databricks) · Nishith Sinha, Arun Pamulapati, Omar Khawaja · Aug 10, 2026

**Type:** Problem & solution

## Summary

An AI agent can exfiltrate private data when one session combines access to confidential information, attacker-controlled content, and an external communication channel, even though each capability is individually authorized. Omnigent's contextual policy tracks those three legs as session state: private data, untrusted content, and exfiltration, with human-defined tool or argument-based classifications. It allows ordinary actions until both prerequisite legs are lit, then denies the outbound call that would complete the trifecta. In the support assistant example, a user-supplied ticket instructs the agent to read internal Q3 revenue figures and email them externally; without the policy, the confidential number leaves in a reply, while the protected run blocks that email. A password-reset ticket still proceeds because it lights only the untrusted-content leg, and an empty internal lookup does not light the private-data leg.

## Context

The lethal trifecta arises when a session combines private-data access, untrusted content, and an outbound communication channel. Per-action authorization checks approve each capability separately and cannot detect that their sequence enables data exfiltration.

## Approach / What changed

A human-defined Omnigent contextual policy records three session-state legs and denies an outbound call when private-data and untrusted-content legs are already lit. Leg assignments can be based on tools or inspected call arguments, and remain fixed during the session.

## Takeaways

- The policy blocks only the third leg after private-data and untrusted-content access have occurred; having both prerequisite legs lit does not itself stop the session.
- A support ticket can be the untrusted input that directs an agent to read internal revenue data and send it to an external mailbox.
- Leg classification is controlled by a human in agent configuration, preventing the agent from reclassifying data or content at runtime.

**Tags:** [Architecture](https://yomu.fyi/topic/architecture), [LLMs](https://yomu.fyi/topic/llm)

- Source: [Databricks](https://www.databricks.com/blog/innocent-until-combined-blocking-lethal-trifecta-omnigent-contextual-policies)
- Source URL: https://www.databricks.com/blog/innocent-until-combined-blocking-lethal-trifecta-omnigent-contextual-policies
- Ingested by Yomu: 2026-08-30T16:51:49.444Z

[Read original post](https://www.databricks.com/blog/innocent-until-combined-blocking-lethal-trifecta-omnigent-contextual-policies)