Trust Labels

The problem #

Prompt injection works because a model cannot tell “instructions” from “data”. Defences at the model layer (classifiers, prompt hardening) leak, and attackers can adapt. At the end of October 2025 Meta proposed the Agents Rule of Two: until injection is reliably solved, a session should have at most two of three properties.

The more dependable approach is to bound the consequences outside the model. Storage is exactly where every read and write passes, so it is a natural place to turn this rule into a testable invariant.

How it works #

• Labels. Three origins, three sensitivities and a reviewed flag (set by a gate approval). Import points (web pages, email, uploads) default to external; when a secret scanner finds credentials, it labels them secret automatically.
• Session taint. The summary of everything a run has read (from the read manifest); within a session it only grows, and a new session starts clean.
• The invariant. A = the session has read external; B = the lease may read private or above (threshold configurable); C = the lease may propose a merge into a protected tree, share, delete or send data out. When all three hold in one session, the call that triggers C is denied or sent to a gate.
• In practice: under a lease that has both B and C, once a session has read external content, every later C-type action needs a person. To avoid that friction, do the “read external content” work in a separate session without B and pass results on through a structured handoff only.
• Propagation. Derivations made by the NAS itself (indexes, summaries) deterministically inherit the union of their input labels; files a run writes inherit the run’s session taint (the conservative choice).
• Declassification. Only through a Human Gate, or a structured handoff: the output of the tainted session is restricted to fields validated by a JSON Schema (enums, IDs, bounded strings), and only after validation may a privileged session read it. Only what can be validated deterministically can be trusted.
• Enforcement is at the gateway and the mount (which know the lease and the session), not inside the model.

Start small #

• Do just two things: label files in the import directory external, and by default give a run that has read external no egress and no protected merge without a gate.
• Write the policy as deterministic rules in Cedar or Rego, and give readable reasons on denial.
• Run in “log only” mode for a week to see what it would block by mistake, then switch enforcement on.

Interface sketch #

Illustrative only. Field names may change before specification v0.3.

# Deterministic policy (Cedar- or Rego-style rules can express the same thing)
session_invariant: rule_of_two
properties:
  A: session.read_origin includes "external"
  B: lease.sensitivity_max >= "private"
  C: lease allows propose_protected | share | delete | egress
on_would_complete_ABC: gate        # never "allow"
rules:
  - id: r-merge-1
    when: session.A and op == "merge" and target.protected
    then: gate
  - id: r-secret-1
    when: session.read_sensitivity == "secret" and op == "egress"
    then: deny

What the specification asks for #

• Every import point MUST assign a default label; external content MUST be labelled external.
• Session taint MUST only grow within a session.
• Policy evaluation MUST be deterministic and MUST NOT call an LLM.
• A call that would let a session complete A+B+C MUST be denied or sent to a gate.
• Declassification MUST go through a gate or a schema-validated structured handoff.
• Derived data MUST inherit the union of its input labels.

Borrowed, and what is new #

What follows is all established thinking. What is new: implementing session taint at the storage boundary with the read manifest, and applying labels to memory writes and derived data. We deliberately keep the label lattice to 3×3 because fine-grained lattices lead to label explosion in practice. OpenClaw already does origin labels and isolation inside a single runtime; our difference is only to put this in shared storage.

• Agents Rule of Two (Meta)
• The lethal trifecta
• CaMeL
• Fides
• Design Patterns for Securing LLM Agents against Prompt Injections
• OpenClaw memory architecture

Honest limits #

• This is not a defence against prompt injection; it limits consequences.
• The NAS cannot see tools outside it (a browser, email), so it needs the runtime’s cooperation.
• Taint is conservative and brings friction and false positives; free text outside structured schemas can still carry an attacker’s words.
• Covert channels cannot be eliminated.

Open questions #

• Should the granularity of a label be the file or the paragraph?
• How is the label vocabulary governed across tenants?
• How can false positives be reduced?

Questions #

Related concepts #

• Human Gate Appears only before irreversible, outward-facing or privilege-raising actions, and shows the real diff.
• Agent Memory Notes you can read and edit are the truth. Indexes are a cache you can throw away.
• Capability Lease A narrow authorization for one run, with an expiry and budgets. Child leases can only be narrower.