SALTT Tech Insights, Episode: Prompt Injection Is a Permissions Problem
Hosts: Trinity (host) and Nobby (Chief Technology Officer)
Duration: ~20 minutes
Companion article: Prompt Injection Is a Permissions Problem
In this episode of SALTT Tech Insights, Trinity and Nobby unpack a shift in how AI security has to be done: why a model's built-in guardrails don't stop data walking out the door, and why prompt injection is, at heart, an authorisation and permissions problem.
Grounded in guidance from the Australian Signals Directorate (ASD) and the UK's National Cyber Security Centre (NCSC), and in incident data from Google Threat Intelligence, the conversation covers why language models can't separate system instructions from untrusted content, how the Lethal Trifecta test works, what really happened in ShareLeak (CVE-2026-21520) and the Johns Hopkins coding-agent leaks, and how the AI harness (the independent control layer around the model) enforces least privilege, sub-agent isolation and human approval gates.
Model safety filters aren't security boundaries. Built-in guardrails raise an alarm inside a black-box model, but they can't enforce a boundary. In ShareLeak, a flagged prompt still exfiltrated data through Outlook because the agent's permissions allowed it.
The "inherently confusable deputy". LLMs process system instructions and external data in the same context window with no structural boundary between them; as the NCSC puts it, there's only ever "next token". SQL injection was solved with parameterised queries. Prompt injection can't be patched out of the model the same way.
The Lethal Trifecta. An agent becomes an exfiltration path when it combines access to private data, exposure to untrusted content, and an external communication channel. Break any one of the three and the attack has nowhere to go.
The harness versus the model. The model is the brain; the harness is the body. The harness covers the UI, tool registry, permission model, execution environment, connector layer, session store and logging. Models change every few months. The harness is the enduring capability your organisation owns and governs.
Dynamic privilege dropping. When an agent reads content from an untrusted source (public PR comments, web forms, external email), its permissions should immediately drop to match that source.
Context management is a security control. Summarising a poisoned context compresses the payload and makes it look more authoritative. Stale or untrusted context should be cleared and a fresh session started, not summarised in place.
Ask technology partners to answer these seven questions in writing before signing or renewing an AI platform contract.
SALTT Technologies works with Australian organisations on agent inventories and identity governance, harness threat modelling and secure design review, third-party assurance for AI-enabled platforms, and the layered guardrail and detection architecture around them. These fall within our AI Security, Governance, Risk & Compliance, and Security Architecture & Engineering capability areas. Contact us at saltt.tech.