AG4Architect AI agent scope
Injection-resistant architecture review
Prompt injection is not solved by filters. AG4 redesigns agent workflows so that injected text cannot reach the actions that matter.
Price on requestAsk about AG4How pricing works
What it is for
An agent that reads untrusted content can be instructed by it. MITRE ATLAS records this as indirect prompt injection: malicious prompts hidden in data the model ingests from another channel, such as a database or a website.[1] Guardrails reduce the rate; architecture removes the path. AG4 is the architecture.
The tools we use
- The Agents Rule of Two. Within one session an agent should have at most two of three properties: it processes untrustworthy input, it can access sensitive systems or private data, and it can change state or communicate externally. If a task needs all three, it needs a fresh session or a human in the loop.[2] We score every workflow against it.
- Capability separation. CaMeL extracts the control and data flow from the trusted user request, so that untrusted data cannot change the program’s flow, and uses capabilities to stop private data leaving through tool calls.[3]
- Design patterns. Work published in June 2025 proposes principled patterns for building agents with provable resistance to prompt injection.[4] Plan-then-execute and dual-model designs are among the options we test against your workflows.
What you receive
A data-flow map of each workflow, its Rule of Two score, a redesign where the score is unsafe, and a risk register for what remains, with each entry mapped under the TriOngle Method.
Framework mapping
The frameworks this scope is aligned with, the version we map to, and what we map. Aligned with means we use the framework; it does not mean any body has certified TriOngle.
| Framework | Version | What we map |
|---|---|---|
| OWASP Top 10 for Agentic Applications | 2026 edition, 9 Dec 2025[5] | ASI01 Agent Goal Hijack; ASI02 Tool Misuse and Exploitation |
| Agents Rule of Two | 31 Oct 2025[2] | The three properties, scored per workflow |
| CaMeL: Defeating Prompt Injections by Design | arXiv 2503.18813, Mar 2025[3] | Separating control flow from untrusted data |
| Design Patterns for Securing LLM Agents against Prompt Injections | arXiv 2506.08837, Jun 2025[4] | Design patterns with provable resistance |