How to Design Architectural Guardrails Around AI Agents

AI agents that research the internet, access internal resources, and take actions are vulnerable to prompt injection attacks. To mitigate these risks, architectural guardrails are essential, complementing user-level and prompt-level defenses. The "action selector" pattern restricts an agent's capabilities by only allowing it to choose from a predefined list of actions, preventing it from executing arbitrary commands. Another approach is the "plan-then-execute" pattern, where the agent first creates a fixed plan of action before interacting with any untrusted external data, thus preventing attackers from controlling the execution flow. While these patterns enhance security, they can also introduce rigidity and may not be a complete solution to all vulnerabilities.