Trust Boundaries: Human Consent, Prompt Injection, and Remote Agents

For gstack, a tested workflow is not automatically an authorized workflow. This chapter focuses on the boundaries around what an agent may read, interpret, mutate, share, and send. The practical judgment is which controls protect authority, which controls limit capability, which controls merely record events, and where the repository explicitly says its defenses stop.

The central rule is simple: material returned by a web page is content, not instruction. From that rule, gstack builds a wider model of human consent, credential handoff, daemon tokens, remote tunnels, content filters, and egress receipts. These controls address different failures. Treating them as one general “security layer” would make the system sound safer than the evidence supports.

The user remains the authority

The project’s ethos says that models recommend and users decide. That principle appears in practical workflows, not only in a manifesto. Autoplan can resolve a mechanical choice, but a close design choice or a User Challenge waits for a final approval gate. Office-hours stops before implementation until the user approves an approach. A browser skill can inspect and fill a page, but a mutation on a non-local site requires an explicit question that names the intended actions.

This is a boundary around authority. The agent may be capable of clicking a button, but capability does not establish permission. A user may want a staging form submitted, or may want only a dry run. The system should not infer the difference from the presence of a button. The same applies to a model recommendation that two reviewers agree on. Agreement is evidence that an option deserves attention, not a mandate to override the user’s stated direction.

Credentials are kept on the human side of this boundary. Sign-in walls, passwords, one-time codes, payment information, CAPTCHA solving, and identity verification remain with the user in the browser. The agent can continue after the user says the step is complete, but it is not supposed to type, read, or print the secret. This design trades some smoothness for a clearer ownership rule: the agent can use an authenticated session without becoming the handler of the credential that created it.

/careful, /freeze, and /guard add different kinds of protection. Careful warns before destructive commands. Freeze restricts Edit and Write operations to a directory. Guard combines the two. These tools reduce accidental deletion, force-pushes, broad edits, or debugging drift. The source is explicit that they are accident prevention, not a security sandbox. A Bash command can still bypass an edit boundary if it directly modifies a file, and a warning does not prove that a command is safe in every environment.

This distinction matters because safety language often collapses two questions. “Should the agent be allowed to do this?” is an authority question. “Can the agent accidentally do something broader than intended?” is an accident-control question. gstack’s consent gates address the first in selected workflows. Careful and freeze address the second. Neither one makes the agent trustworthy by itself.

A page can speak without being trusted

A browser page is an unusual input because it contains language, controls, and sometimes text written specifically to influence an agent.