Loading patterns…
Dual LLM & Capability Security (CaMeL)
Splits the agent into a privileged LLM that sees only trusted user instructions and plans control and data flow, and a quarantined LLM that processes untrusted content but can never influence control flow. A capability-tracking interpreter enforces explicit data-flow policies, so instructions injected into tool outputs can never trigger unauthorized actions. This is defense by design rather than probabilistic filtering.
In 30 seconds
- What
- Separates a trusted LLM that plans control flow from an untrusted LLM that only extracts data, with capability tags enforcing which data can trigger which actions.
- When to use
- Agents process untrusted user input or tool outputs and must prevent prompt injection from altering execution paths or accessing restricted resources.
- Watch out
- High implementation complexity and runtime overhead; capability tracking adds latency and requires careful policy definition to avoid breaking legitimate workflows.
Ask the AI expert about this pattern
Opens the assistant with your question prefilled. You review it before sending.
Dual LLM & Capability Security (CaMeL): Overview
Splits the agent into a privileged LLM that sees only trusted user instructions and plans control and data flow, and a quarantined LLM that processes untrusted content but can never influence control flow. A capability-tracking interpreter enforces explicit data-flow policies, so instructions injected into tool outputs can never trigger unauthorized actions. This is defense by design rather than probabilistic filtering.
- Privileged LLM plans control flow from trusted input only
- Quarantined LLM extracts data from untrusted content, never issues commands
- Capability tags track data provenance through every value
- Interpreter enforces data-flow policies before each tool call
- Injected instructions in tool outputs cannot reach the control path
- Formal security guarantees instead of best-effort prompt filtering
The Agent Architect
One pattern, one tradeoff, one production failure story. A short weekly briefing for people building agentic systems.
Weekly email, one-click unsubscribe. We only use your address to send the briefing.
References
The papers, specifications, and repositories this pattern is based on.
From the engineer behind this catalog
Get your agent system red-teamed
The controls described here only hold if somebody tries to break them. Have yours tested the way a real attacker would: prompt injection, jailbreaks, tool misuse and data exfiltration, every finding written up next to its fix.
€750 instead of €1,500, one week, written report and walkthrough call, until 30 September