The Safety Stack: Contain What the Model Cannot Guarantee
Agent-assisted coding needs more than a better prompt because the workflow crosses boundaries that model behavior cannot enforce by itself. This chapter focuses on how input filters, model-level safeguards, sandboxes, deterministic policies, and human oversight divide the work of protection. The practical judgment is not to choose one winning defense, but to place each control where it can reduce a particular failure and to reserve hard limits for actions whose consequences a model should never be able to authorize alone.
The distinction matters because the preceding threat model contains two different uncertainties. The agent may misunderstand instructions or follow hostile content. The surrounding system may also give that interpretation too much reach through a tool, credential, workspace, CI runner, or deployment interface. A defense that addresses only the first uncertainty can leave the second untouched. Conversely, a strict execution boundary can limit damage without explaining whether the change itself is appropriate. A usable design needs both layers, with clear ownership at each transition.
Statistical defenses reduce risk; system boundaries contain it
The first layer operates on what enters the model. Input-level defenses can detect suspicious instructions, remove malicious material, or transform content so the model is less likely to treat data as a command. In a coding workflow, that might mean treating repository text, issue descriptions, documentation, or tool output as untrusted context and looking for attempts to redirect an action. Techniques such as spotlighting or other structured transformations aim to make the difference between instructions and data more salient before the model reasons over it.
This layer is useful when the system can identify a suspicious input early and respond without breaking the task. It becomes less reliable when benign content greatly outnumbers malicious content. The base-rate problem means that even a detector with a low false-positive rate can produce many false alarms when attacks are rare. Discarding every flagged document may protect the model while making repository research unusable. Heavy detection also adds cost and latency at every step of a multi-stage workflow, and text-only checks may miss instructions embedded in images, audio, or other modalities.
Input filtering should therefore be understood as attack-volume reduction, not proof that the remaining content is safe. A coding agent may encounter a benign sentence that resembles an instruction, or a carefully phrased attack that a detector does not recognize. The response to a flag matters as much as the score: quarantine, annotate, ask for a different source, or continue with restricted capabilities are different choices. The right choice depends on whether the content is necessary for the task and what the next action could affect.
The second layer is the model itself. Instruction hierarchy trains a model to give different priority to system, user, and lower-trust content. That can improve resistance when instructions conflict, and newer models may perform better on some hierarchy evaluations. But the roles are still represented through a learned convention in a flattened token sequence. The model has no native, deterministic barrier that prevents it from attending to or following a lower-priority segment. Recency and a general tendency to comply with the latest request can also influence its response.
That limitation is especially important for agent-assisted coding because the most dangerous conflict is not a change in capitalization or output length. It is a conflict over whether the agent should read a credential, run an installer, change a CI permission, or publish a deployment. A model may correctly describe the higher-priority rule and still produce an unsafe action under a novel combination of context and pressure. Evaluations that test only small instruction conflicts can therefore create more confidence than security-relevant behavior warrants.
Model-level defenses remain valuable.