A prompt is a wish. A perimeter is when the model physically cannot reach files or a shell: native tools off, an MCP intermediary, Docker per project+task, a filter before execution, an audit trail. Below is a working reference — and where the design gives way.
Continue reading “How to secure an AI coding agent without relying on the system prompt”