Giving an agent a human credential is convenient in the same way giving an intern the master key is convenient. The system can reach everything the person can reach, while the prompt is expected to supply the judgment, restraint, and context that normally limit how the credential gets used.
A new preprint proposes Out-of-Band Policy Enforcement, or OBPE, as a separate trusted layer between the agent and its tools. The gateway authorizes a typed operation and resource, narrows a query before it reaches the backend, and filters records, fields, or values on the way back. A data owner defines the maximum grant. The agent can request less access, but cannot widen the ceiling.
The authors tested an HTTP proxy prototype against mocked Jira and ServiceNow environments across four models and 20 adaptive red-team tasks. In 3,621 trials, they report that protected-data failures fell from 57.6 percent to 0.2 percent. General task fulfillment also fell, from 79.1 percent to 60.9 percent, while their paired safe-and-useful completion measure rose by 21.8 points.
That tradeoff is the whole design problem. A control that blocks everything is secure and useless. A prompt that permits everything is productive until it is catastrophic. The external boundary creates a place to make that decision deterministically, log it, test it, and assign policy ownership without asking the same model to be both worker and security guard.
The paper is a preprint, and the authors name important limits. Filtered row counts can become an oracle. A model can sometimes reconstruct a protected value that never entered context. Write controls, durable approval, temporal policy, and aggregate leakage sit outside the evaluation. OBPE is not proof that agent security is solved. It is evidence that the strongest permission rule should live somewhere the agent cannot rewrite with a persuasive sentence.
LaunchPad positionPrompts can describe permission. An independent gateway can enforce it. The paper's results are promising, but the evaluation excludes several hard problems, including durable approvals and broader information-flow guarantees.
This report draws on the linked primary sources and reputable reporting. Company statements are treated as claims until independently demonstrated.