Separate request from authority
A persuasive model response is still input. It cannot change field policy, read limits, expiry, destination or memory treatment.
Least privilege
AI-agent security starts with less access
The model may request exact facts and explain why. A separate policy—not the model—must decide what the task receives.
Use temporary context capsules
Release only approved fields for one task and discard the temporary context after the result.
Show the receipt
Record requested, released and withheld fields so an owner can compare the result with the actual access path.
The practical rule