Eight regexes and a frozenset: the honest split between detecting injection and containing it

The regex tuple in this pattern has eight entries ^[8], and each keys on a specific English imperative: "ignore all previous instructions", "new system instructions:", "do not tell the user" ^[7]. Rephrase the payload without those exact shapes and a regex matches nothing. The author says as much in the prose: screening is best-effort, and the boundary is the real control ^[14].

That concession is the interesting part, because it is where most write-ups stop. The stated reason is structural rather than tuning: once untrusted text sits in the context window it is not distinguishable from the user's request, since both arrive as tokens ^[2], so the author frames injection as a provenance problem instead of a text-classification problem ^[3].

What actually holds the line is six lines in `before_tool`, which deny any call whose name is not in the run's `allowed_tools` and return a reason saying the original goal does not justify it ^[11]. The set is a frozenset fixed once at run start ^[12]. Notice what the check reads: the tool name, not the arguments. Against the sample ticket, which asks the agent to pull API credentials and mail them to an external address ^[1], an envelope of ticket-reading and knowledge-base tools wins by omission. An agent whose legitimate job includes sending mail has a mail tool in its envelope, and the identical deny check waves the call through. Containment lives entirely in how narrowly each run's envelope is cut, which is per-workflow design labour, not a product you buy.

The second load-bearing gap is disclosure. When spans are removed, the hook rewrites the tool result: matches are replaced with a removal marker, and a warning carrying the number of removed spans plus an instruction to treat the source as hostile is prepended, while the hits go into a findings list ^[9]. The quarantine notice is applied to every untrusted result whether or not anything matched ^[10], which is the right call, since provenance the model can see beats provenance it infers. But whether a live model then tells the user about the attempt ran from 0/3 to 3/3 across the suite ^[13], which means at least one model reported nothing in three tries ^[15]. Anything that depends on the model relaying the incident is not an alerting path. The findings list is.

One thing the supplied text cannot answer: it cuts off mid-word while describing what the envelope's allowed tools are set from ^[16]. That is exactly the seam that decides whether binding is enforcement or advice. If the envelope is derived from anything the model or its inputs can influence, the frozenset is a formality; if it comes from an out-of-band authorisation, the design does what it claims. The excerpt also reports no figure for the purpose-built classifier it says it ran the same payload through ^[18], so the comparison the post is built around is asserted here rather than shown.