--- title: Innocent until combined: Blocking the lethal trifecta... description: Omnigent's contextual policies address the 'lethal trifecta' threat in AI agents — the dangerous combination of private data access, untrusted content... canonical: https://daily.dev/posts/innocent-until-combined-blocking-the-lethal-trifecta-with-omnigent-contextual-policies-q9u0gbjv7 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies | daily.dev og:description: Omnigent's contextual policies address the 'lethal trifecta' threat in AI agents — the dangerous combination of private data access, untrusted content... og:url: https://daily.dev/posts/innocent-until-combined-blocking-the-lethal-trifecta-with-omnigent-contextual-policies-q9u0gbjv7 og:image: https://api.daily.dev/og/posts/q9U0gbJV7.png og:image:alt: Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies **[databricks](https://daily.dev/sources/databricks)** · 7 min read · 0 upvotes · 0 comments ## Summary Omnigent's contextual policies address the 'lethal trifecta' threat in AI agents — the dangerous combination of private data access, untrusted content exposure, and an outbound communication channel. Unlike per-action authorization checks that approve each capability individually, contextual policies track session state across all three legs and block the outbound action only when both prerequisite legs (private data read and untrusted content ingested) are already lit. A concrete support-ticket prompt injection attack is demonstrated: without the policy, an agent exfiltrates internal Q3 revenue figures to an attacker-controlled email; with the policy attached, the send_email call is denied the moment the trifecta would complete. Normal work (e.g., a password-reset ticket requiring no sensitive data) is unaffected. Tool classifications are set by humans in agent config, not by the agent itself, preventing prompt injection from reclassifying sensitive resources. The approach extends to multi-agent systems by treating sub-agent instructions as untrusted content. Omnigent is open source and currently in alpha. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is the 'lethal trifecta' in AI agent security and why can't per-action authorization stop it? The lethal trifecta is the dangerous combination of three individually legitimate capabilities in a single agent session: access to private data, exposure to untrusted content, and an outbound communication channel. Per-action authorization clears each capability individually because no single action is wrong. The threat only emerges from the sequence — untrusted content (e.g., a malicious support ticket) can instruct the agent to read private data and then exfiltrate it via the outbound channel. _Teams securing AI agents against prompt injection track patterns like this on daily.dev._ ### How does Omnigent's lethal trifecta contextual policy decide when to block an outbound action? The policy tracks three session-state flags — private data accessed, untrusted content ingested, and exfiltration attempted. Each flag is lit when the agent calls a tool assigned to that leg, and stays lit for the rest of the session. The outbound call is denied only when both the private-data and untrusted-content legs are already lit. Tool-to-leg assignments are defined by a human in the agent config and cannot be changed by the agent at runtime. _Developers building policy-governed agent systems find implementation patterns for this kind of defense on daily.dev._ ### Can Omnigent's lethal trifecta policy handle multi-agent systems where one agent calls another? Yes. In multi-agent setups, instructions arriving from a sub-agent are classified as untrusted content, the same as any external input the agent reads. If a sub-agent causes the orchestrating agent to read private data and then attempt an outbound call, the session already has two legs lit and the exfiltration is blocked by the same policy logic used for single-agent scenarios. _Engineers designing multi-agent architectures with security guardrails follow developments like this on daily.dev._ ## Similar posts on daily.dev - [Contextual Policies in Omnigent: Using session state to better govern AI agents](https://daily.dev/posts/contextual-policies-in-omnigent-using-session-state-to-better-govern-ai-agents-bhluqrzzz) · databricks · 2 upvotes · 0 comments - [Permission isn't purpose: Intent-based authorization in Omnigent](https://daily.dev/posts/permission-isn-t-purpose-intent-based-authorization-in-omnigent-allg5fxld) · databricks · 0 upvotes · 0 comments - [The Lethal Trifecta: Why Your AI Agent Could Be a Security Liability](https://daily.dev/posts/the-lethal-trifecta-why-your-ai-agent-could-be-a-security-liability-4nfnrjhax) · Snowflake Community · 1 upvotes · 0 comments - [Agents are rewriting the rules of security. Here’s what engineering needs to know.](https://daily.dev/posts/agents-are-rewriting-the-rules-of-security-here-s-what-engineering-needs-to-know--khtu9taim) · The New Stack · 0 upvotes · 0 comments - [Agentic AI and Security](https://daily.dev/posts/agentic-ai-and-security-zqrngwfxj) · Martin Fowler · 40 upvotes · 3 comments --- Tags: [#ai-agents](https://daily.dev/tags/ai-agents), [#ai-security](https://daily.dev/tags/ai-security), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/innocent-until-combined-blocking-the-lethal-trifecta-with-omnigent-contextual-policies-q9u0gbjv7) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies","url":"https://daily.dev/posts/innocent-until-combined-blocking-the-lethal-trifecta-with-omnigent-contextual-policies-q9u0gbjv7","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/innocent-until-combined-blocking-the-lethal-trifecta-with-omnigent-contextual-policies-q9u0gbjv7"},"datePublished":"2026-08-10T18:12:30.089Z","dateModified":"2026-08-10T18:13:59.018Z","description":"Omnigent's contextual policies address the 'lethal trifecta' threat in AI agents — the dangerous combination of private data access, untrusted content...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15e9a4d3a911deb26a541e8703d133d5?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/15e9a4d3a911deb26a541e8703d133d5?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"databricks","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"databricks","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/fa7aa720f2db4d1eba826814730482c8","url":"https://daily.dev/sources/databricks"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/innocent-until-combined-blocking-the-lethal-trifecta-with-omnigent-contextual-policies-q9u0gbjv7","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"ai-agents,ai-security,prompt-injection,data-exfiltration","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"databricks","item":"https://daily.dev/sources/databricks"},{"@type":"ListItem","position":3,"name":"Innocent until combined: Blocking the lethal trifecta with Omnigent Contextual Policies"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/innocent-until-combined-blocking-the-lethal-trifecta-with-omnigent-contextual-policies-q9u0gbjv7#faq","mainEntity":[{"@type":"Question","name":"What is the 'lethal trifecta' in AI agent security and why can't per-action authorization stop it?","acceptedAnswer":{"@type":"Answer","text":"The lethal trifecta is the dangerous combination of three individually legitimate capabilities in a single agent session: access to private data, exposure to untrusted content, and an outbound communication channel. Per-action authorization clears each capability individually because no single action is wrong. The threat only emerges from the sequence — untrusted content (e.g., a malicious support ticket) can instruct the agent to read private data and then exfiltrate it via the outbound channel. Teams securing AI agents against prompt injection track patterns like this on daily.dev."}},{"@type":"Question","name":"How does Omnigent's lethal trifecta contextual policy decide when to block an outbound action?","acceptedAnswer":{"@type":"Answer","text":"The policy tracks three session-state flags — private data accessed, untrusted content ingested, and exfiltration attempted. Each flag is lit when the agent calls a tool assigned to that leg, and stays lit for the rest of the session. The outbound call is denied only when both the private-data and untrusted-content legs are already lit. Tool-to-leg assignments are defined by a human in the agent config and cannot be changed by the agent at runtime. Developers building policy-governed agent systems find implementation patterns for this kind of defense on daily.dev."}},{"@type":"Question","name":"Can Omnigent's lethal trifecta policy handle multi-agent systems where one agent calls another?","acceptedAnswer":{"@type":"Answer","text":"Yes. In multi-agent setups, instructions arriving from a sub-agent are classified as untrusted content, the same as any external input the agent reads. If a sub-agent causes the orchestrating agent to read private data and then attempt an outbound call, the session already has two legs lit and the exfiltration is blocked by the same policy logic used for single-agent scenarios. Engineers designing multi-agent architectures with security guardrails follow developments like this on daily.dev."}}]} ```