Research summary
This research note describes a three-layer interception model for LLM execution in Vtslx AO. It addresses prompt injection, tenant and resource abuse, sensitive-data handling, tool authorization, streaming termination, and audit semantics. The central finding is architectural: no one detector can make an agent safe; controls must attach to the request boundary, the execution decision, and the destination/output boundary.
1. Threat model and design principles
We assume that model input can contain untrusted instructions, that an otherwise authorized user can request an unsafe action, that tools have uneven side effects, and that a streaming response can become unsafe after an initially acceptable prefix. We therefore separate identity from content, capability from model text, and observability from retention of sensitive bodies. A policy outcome may transform, require confirmation, isolate, rate-limit, or block; it must never silently grant a capability.
2. Three-layer architecture
Ingress establishes whether a request is a valid, bounded, authenticated request. The gateway binds the selected model, tool set, budgets, content policy, and audit context to this execution. Egress validates destination, data scope, tool parameters, and returned output. Any denial, review request, or stream termination enters the same safe response surface.
拦截决策探索器
选择策略层和风险类型，查看公开职责与推荐处置；不公开规则阈值、检测特征或供应商配置。
The layer boundary is intentional. A schema check cannot decide whether a tool call is permitted; a route decision cannot make an unsafe destination safe; a downstream output filter cannot replace tenant authentication.
3. Ingress: admission and attack-surface reduction
Ingress verifies trusted transport or proxy context, identity and tenant binding, request size and schema, replay signals, rate allocation, and protocol eligibility. It normalizes public inputs before later policy decisions and rejects malformed or resource-abusive traffic early. It does not claim to determine the truth of arbitrary model content. Instead, it narrows the set of requests that can consume model or tool capacity and preserves the identity needed downstream.
4. Gateway: execution policy and tool authorization
The gateway is where a request becomes one controlled run. It chooses an allowed route, binds a model capability profile, constrains tools to least privilege, assigns budgets, and records a minimal policy decision. Untrusted document text, retrieved pages, and tool output must remain data; they cannot promote themselves to system-level instruction. A model proposing an action is not an authorization event. High-impact tools require an explicit host policy and, where appropriate, confirmation from the authorized human.
5. Egress: destination, data, and output
Egress verifies credentials and destinations, minimizes fields to the permitted scope, validates parameters and side effects, and applies output policy while results stream. A safe beginning does not guarantee a safe completion: the run can be terminated with a typed, minimized failure rather than leaking a partial tail. The execution record should contain decision evidence and correlation identifiers, not a default copy of sensitive prompts or response bodies.
6. Interception matrix and state
The matrix distinguishes prevention, confirmation, isolation, and observability controls across each layer. It also makes failures actionable: clients can tell an incomplete stream from a successful result, and operators can measure where a policy is activated without receiving detection thresholds or adversarial signatures.
| 风险类 | 首选层 | 默认处置 | 可安全公开 | 不应公开 |
|---|---|---|---|---|
| 身份无效/范围不足 | 入口 | 阻断或挑战 | 错误类别、重试路径 | 身份解析规则 |
| 超额/异常速率 | 入口+网关 | 延后、限速、阻断 | 限额类别 | 阈值、反滥用信号 |
| 提示注入/指令冲突 | 网关 | 变换、阻断、审查 | 高层风险类别 | 特征、提示模板、置信分数 |
| 越权/高影响工具 | 网关+出口 | 确认或阻断 | 不可用/需确认状态 | 授权规则、资源清单 |
| 敏感数据外发 | 网关+出口 | 脱敏、最小化、阻断 | 数据政策类别 | 匹配模式 |
| 不安全输出/链接 | 出口 | 清理、失败、终止流 | 不可交付类别 | 检测器实现 |
7. Governance and limitations
Policies require versioning, review, staged rollout, rollback, and tenant-aware audit. Metrics such as refusal rate or stream-interruption rate are signals, not standalone quality scores: they must be read with workload mix and authorized outcomes. This public description does not disclose rules, thresholds, detector features, vendor configuration, or secret-routing details. It also cannot eliminate application-owner responsibility for tool design and authorization.
8. Conclusion
The three-layer model gives each security decision a natural home: ingress establishes the request boundary, the gateway binds the run’s capability and policy, and egress protects destinations and outputs. Its value is not a claim of perfect detection; it is a repeatable, auditable way to deny unsafe execution and degrade safely when uncertainty remains.