An agent reads a private ticket, then a prompt-injected page tells it to post the contents to a public issue. A model can follow the instruction; a tool boundary can still prevent the write.

Joey Orlando and Innokentii Konstantinov will show how recoverable information-flow control can secure multi-step agents without making every restriction a dead end. Using the open-source OpenAPPA framework with MCP and a Kubernetes-native kagent example, they trace audience and trust labels through tool results, check actions before dispatch, and validate outputs before those outputs enter agent context. They then show how scoped approval, sanitization, and isolated child trajectories let legitimate work continue after a block.

The speakers will share task-completion and attack results, their limits, and a practical path to add tool contracts to an existing agent stack. Attendees will leave able to design and test explicit data-flow policies for their own tools.