Why AI Prompt Filters Fail and How Execution-Path Enforcement Fixes It

Security researcher Simon Willison identified a 'lethal trifecta' that makes coding agents inherently risky: simultaneous access to private data, untrusted content, and outbound capabilities like network calls. Most AI guardrails attempt to intercept threats by scanning prompts or model outputs, but these checks are merely advisory and can be bypassed by cleverly crafted injected text. A tool called Doberman takes a different approach by routing every tool call — shell commands, file writes, and API calls — through a single mandatory decision engine before execution, ensuring no action can bypass the checkpoint. The system operates on two core principles: it fails closed, meaning any uncertainty results in a denial rather than a default allow, and it is raise-only, meaning its policies can only be tightened automatically but require human authentication to loosen. Additionally, a 'taint floor' mechanism tracks sensitive data accessed during a session and automatically blocks any subsequent attempt to transmit that data outbound, directly countering the data-exfiltration risk.