Agent monitoring and containment

AWS and SANS move agent authorization out of the prompt and into the RBAC layer

Joint guidance from AWS and the SANS Institute argues that an agent's system prompt can be talked around, so retrieval has to be scoped to the requesting user's own entitlements and filtered before the model sees results.