Prompt Shield: Email Prompt-Injection Firewall for AI Agents

Direct Answer

If your AI agent executes email instructions directly, you need prompt-injection controls at runtime. Prompt Shield adds that control layer natively in THRD: deterministic scoring on inbound content plus action firewall on /v1/reply and /v1/send.

This is the key difference versus standard mail providers: they focus on spam or phishing for humans. Prompt Shield focuses on command safety for agents.

What Prompt Shield Detects

The v1 engine is deterministic and explainable. No hidden model judgement. Each signal adds weighted score, false-positive reducers apply, and the final level drives policy.

Risk thresholds:

• low: 0-29
• medium: 30-59
• high: 60-79
• critical: 80-100

{
  "security": {
    "prompt_injection": {
      "engine": "deterministic-v1",
      "score": 72,
      "level": "high",
      "flags": ["role_override_attempt", "tool_execution_request"]
    },
    "policy": {
      "reply": "require_ack",
      "send": "require_ack"
    }
  }
}

Runtime Policy Matrix

Shield is not passive telemetry. It is enforceable policy. Tier determines the action on risky messages and keeps defaults strict for free accounts.

This policy applies to thread replies and to outbound sends when a source message is provided. You can keep low-risk operations fast while still hardening high-risk paths.

ACK Override Flow (Tier 2/3)

For high-risk actions in Tier 2/3, call POST /v1/security/ack and include the returned token when retrying the action. The token is short-lived and context-bound to message + action (+ thread for reply).

POST /v1/security/ack
Authorization: Bearer $THRD_API_KEY
Content-Type: application/json

{
  "message_id": "<inbound_message_uuid>",
  "action": "reply",
  "thread_id": "<thread_uuid>",
  "reason": "Sender is trusted and request is expected in this workflow"
}

POST /v1/reply
Authorization: Bearer $THRD_API_KEY
Idempotency-Key: reply:<event_id>
Content-Type: application/json

{
  "thread_id": "<thread_uuid>",
  "text": "Thanks, processed.",
  "security_ack_token": "sec1...."
}

If token context does not match, THRD rejects the action with explicit error codes. That gives you safe continuation without turning off protection.

API Surface

• GET /v1/messages/:id/security to fetch score, level, flags, and policy for a specific message.
• POST /v1/security/ack to issue a signed temporary override token.
• POST /v1/reply supports optional security_ack_token.
• POST /v1/send supports optional source_message_id and security_ack_token.

The event payload also includes machine-readable security context, so the agent can adapt behavior before attempting a risky action.

When Shield Is Not Enough

Prompt Shield is action firewall v1. It does not rewrite content, and it cannot govern tools outside THRD. You still need basic agent hygiene:

• Explicit tool permissions by environment.
• Secret management outside logs and prompts.
• Idempotency on all side-effect actions.
• Human review for high-impact workflows.

Use Shield as the default gate, not as a replacement for secure architecture.

FAQ

Want the full machine contract? Read /machine.