Secure Claude Workflows with Layered Trust Boundaries
Threat-model direct and indirect prompt injection, data exposure, excessive authority, and unsafe side effects, then enforce layered controls around Claude.
By the end
You will be able to
- Distinguish direct jailbreaks from indirect prompt injection in documents and tool results.
- Separate trusted instructions from untrusted data and minimize sensitive context.
- Enforce least privilege, sandboxing, approval, validation, and output controls outside the model.
- Red-team and monitor the complete workflow rather than relying on one prompt safeguard.
Threat-model the complete workflow
Direct injection comes from a user trying to override application policy. Indirect injection arrives inside content Claude reads, such as a document, email, web page, OCR result, memory, or tool response. Both can target data, tools, identity, or decisions. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
List actors, trusted instructions, untrusted inputs, sensitive assets, tools, permissions, side effects, and consequence of failure. Model behavior is one layer; the surrounding system owns enforceable security. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const response = await client.messages.create({
model: "claude-3-7-sonnet-20250219",
max_tokens: 1024,
messages: [{ role: "user", content: "Analyze the operational boundary and output constraints." }]
});
console.log(response.content[0].text);Separate instructions from data
Keep policy in trusted instruction channels and label the source and trust level of external content. Place third-party tool content in the documented tool-result structure instead of concatenating it into privileged instructions. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Structure and escaping reduce ambiguity but do not create trust. Screen risky inputs and outputs, minimize proprietary prompt details, and never place secrets in model context unless the exact task requires them and policy permits it. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const response = await client.messages.create({
model: "claude-3-7-sonnet-20250219",
max_tokens: 1024,
messages: [{ role: "user", content: "Analyze the operational boundary and output constraints." }]
});
console.log(response.content[0].text);Contain authority and blast radius
Give each workload the smallest data scope, tools, credentials, network access, filesystem access, duration, and budget it needs. Separate read, reversible write, communication, privileged change, and destructive authority. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Sandbox execution, validate every tool proposal, require human confirmation for consequential actions, and verify postconditions. A successful injection should still encounter an external policy boundary. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const response = await client.messages.create({
model: "claude-3-7-sonnet-20250219",
max_tokens: 1024,
messages: [{ role: "user", content: "Analyze the operational boundary and output constraints." }]
});
console.log(response.content[0].text);Layer detection and response
Combine input checks, trust labels, policy prompts, constrained tools, output validation, approval, rate limits, monitoring, and incident response. No individual prompt or classifier is foolproof. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Record safe signals for repeated attack patterns, policy refusals, unusual tool selection, authorization failures, and blocked outputs. Define containment, credential revocation, evidence preservation, user communication, and recovery before release. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const response = await client.messages.create({
model: "claude-3-7-sonnet-20250219",
max_tokens: 1024,
messages: [{ role: "user", content: "Analyze the operational boundary and output constraints." }]
});
console.log(response.content[0].text);Red-team real trajectories
Test benign tasks, direct jailbreaks, malicious retrieved documents, poisoned tool results, data-exfiltration attempts, confused-deputy requests, approval bypass, and delayed attacks across multiple turns. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
Score both final output and trajectory: what Claude read, requested, was authorized to execute, and actually changed. Add every confirmed failure to a versioned regression suite and re-run it when models, prompts, tools, or policy change. In production environments, engineers must account for token utilization patterns, context window pressure, and deterministic execution boundaries. When system constraints or rate limits are approached, explicit retry strategies with exponential backoff and jitter prevent cascading failures across downstream dependencies.
import Anthropic from "@anthropic-ai/sdk";
const client = new Anthropic({ apiKey: process.env.ANTHROPIC_API_KEY });
const response = await client.messages.create({
model: "claude-3-7-sonnet-20250219",
max_tokens: 1024,
messages: [{ role: "user", content: "Analyze the operational boundary and output constraints." }]
});
console.log(response.content[0].text);Practice activity
Red-team and contain a Claude workflow
- Create a data-flow and trust-boundary map for one Claude workflow, including identities, sensitive assets, external content, tools, approvals, and side effects.
- Write eight tests: two benign, two direct injection, two indirect injection, one data-exfiltration, and one approval-bypass case.
- Implement or specify layered prevention, detection, containment, and recovery controls outside the model.
- Run the cases, record output and trajectory evidence, and convert failures into regression tests with owners.
What to produce
- A threat model and control matrix mapping every material threat to an enforceable prevention, detection, response, or recovery control.
- An eight-case red-team report with trajectories, blocked actions, residual risks, regression cases, and accountable owners.
Reflect before continuing
If Claude followed the malicious instruction perfectly, which external control would still prevent the highest-impact harm?
Evidence
Sources and verification
- Mitigate jailbreaks and prompt injectionsAnthropic · verified 2026-07-25
- Reduce prompt leakAnthropic · verified 2026-07-25
- How we contain Claude across productsAnthropic · verified 2026-07-25
- How tool use worksAnthropic · verified 2026-07-25
Knowledge check
Make it stick.
Choose the strongest answer for each question. Your attempts become part of your account transcript.