THE SAFETY ARCHITECTURE

DUAL-AGENT SEPARATION Dual-agent separation splits responsibilities between two agents so that thinking and acting are separated. A planner agent reasons about what should be done and proposes a plan, but it has no ability to run tools. An executor agent actually runs tools, but it only accepts plans in a strict structured format and applies its own independent checks before each action. A restaurant offers an analogy. The waiter takes your order but does not cook, and the chef cooks but does not take orders directly from customers. If a customer tries to talk the waiter into something improper, the chef still applies kitchen rules. WHY THIS HELPS If a prompt injection fools the planner, which reads untrusted content, the harmful plan still must pass through the executor, which has independent checks and does not read the untrusted text. The structured handoff is key. Instead of free text, the planner hands over something like a form with fields for tool name, arguments, and justification, which the executor validates against a schema and a policy. A related design principle is to keep the component that reads untrusted data separate from the component that holds powerful capabilities. LIMITS Dual-agent designs cost more, since they use more model calls, and they add complexity. They also do not help if the executor blindly trusts the planner, so the executor must truly be independent.