Layered Controls Against Indirect Prompt Injection

The problem

• Agents read documents whose instructions they should never treat as authority.
• Classifiers and LLM judges can score an attack as safe while the action still goes ahead.

What MACAW does

• A poisoned month-end runbook tries to slip in a $100 transfer, and the classifier guard passes it.
• MACAW stops it with intent tracking, an independent approval and passkey-bound identity.
• The agent can’t approve its own request.

What’s different

• Reading intent is separate from granting authority.
• Works alongside model-based defenses, enforced independently.
• Stronger proof of approval at the protected action.

Policy and deployment

Policy

Transfers need a signed approval the agent can’t give itself.

Deploy

SecureMCP or SecureMCPProxy in front of the service, with policy in the MACAW control plane.