Our agents cannot change a client’s brand files without a person’s approval

The situation

Our AI agents read and write files in each client’s folder. Some of those files are read back by every later run as trusted instructions: the client’s configuration, brand voice and positioning, ideal-customer profile, messaging guide, and a few similar files.

What it looked like

An owner check already let only three agents change the configuration file, but it covered two files. The writing tool had no list of protected paths, and a write that did not say otherwise went live as approved.

What was actually true

An agent working on untrusted material, such as a scraped web page, a file dropped in an inbox or vendor copy, can be steered by instructions hidden in that material. Such an agent could overwrite the brand voice or the customer profile with poisoned guidance (affiliate links, a flipped target customer, leaked strategy), and every future run would trust it. The agents entitled to write these files are exposed too: onboarding reads the client’s website.

How we found it

The risk was named in the task, part of a wider pass against hidden instructions. We read the writing tool and the owner check, and reused the approval step content drafts already went through.

What changed

Every write, edit or append to those files now lands as a draft pending approval, even from an agent entitled to write them and even when the call asks for "approved". A person has to approve it before it goes live. Ordinary content files are unaffected, and a same-named file in another folder is not caught.

Where it ended

Done and tested: seven new tests pass and the changed code type-checks. Merging was left to our development framework, as designed. An older test of the owner check could not run in that working copy because a library was missing, so it was not re-run.

What we did not claim

That every path is covered. The separate tool that writes into the client’s Google Drive folder still has the owner check but no approval step, and the work said so.

Why it matters beyond this case

An agent proceeds, at speed, and writes a confident account of what it did. So every defect underneath it stops being a defect and becomes a policy.

All our work →