A system prompt is text the model reads alongside everything else it reads, which is why Rittenhouse and Johnson describe prompts as things that can be "bypassed, ignored, or overridden" [3]. The test they put in its place is an entitlement test: if a user cannot pull a record through the normal application interface, the agent acting for that user should not be able to pull it either [4]. That moves the decision out of text the model interprets and into the policy path the application already uses.
The window is narrow because of how the agent is built. It authenticates on behalf of a user, chains tool calls together, and finishes multistep work without pausing for approval, so one bad instruction can reach production data in about the time it takes to log the request [5]. That instruction arrives in untrusted content as hidden text inside ordinary-looking input, and OWASP ranks prompt injection the top threat to AI applications [8]. The authors note it bites at the simplest deployment stage, before an agent has any tools or autonomy [9].
Then the timing. Attack surface minutes measures how long a vulnerability stays exploitable before controls contain it, adapted from dwell time and pointed at the window of exposure rather than the intruder [10]. The authors write that agents act in milliseconds while the metric is denominated in minutes [11]. At one action per millisecond, a single unit of that metric spans roughly 60,000 agent actions [12]. That arithmetic is the case for circuit breakers that suspend an agent on a threshold violation without waiting for a human to confirm [13].
Detection lags for a structural reason. Analytics modeled on human users do not transfer, and an AI coding tool throwing off multiprocess activity reads as anomalous to a legacy detector working exactly as designed [21].
Worth being clear about what kind of document this is. Support comes from adoption and breach-cost research rather than from a case file: McKinsey puts AI adoption at 80% of organizations and AI governance at 10% [14], a 70-point spread and an eight-to-one ratio [15].
The placement argument is blunt. "The model is never the control," the authors write [17], which in practice means content filters that redact PII on the way out, immutable backups held in storage the agent's credentials cannot reach, and a policy engine that evaluates each individual tool call against what it touches and what happens if it goes wrong [18]. Default-deny at that tool invocation layer is what they call the most critical architectural pattern for agentic security, with Cedar and Open Policy Agent named as ways to run it at scale [6], and it is the piece they expect to hold when the others give [22]. Containment, when it fires, hits four layers at once: credentials and sessions, egress, tool access and state, then data scope and logging verbosity [19]. Every prompt, tool call, and response goes to immutable storage so the decision chain can be reconstructed later [20].
