Declare attacker-reachable context
Email, web, documents, MCP tool output, and A2A messages are represented by source type, ingestion time, and digest—not retained content.
Govern the consequence, not the prompt
TrustRail does not claim to identify every malicious instruction. It carries untrusted influence into the authorization decision and makes consequential action harder when the context is attacker-reachable or missing.
Influence becomes a policy fact
Count what the context touched
The approver is told how many consequential fields an untrusted source reached, and that count raises the risk score and the escalation it triggers. Which fields were touched is recorded in the influence manifest and bound into its digest; it is not shown on the approval screen today.
Influence only tightens
The engine evaluates influence-dependent policy twice and suppresses any outcome where caller-supplied influence would have widened authority.
Trace the initiating authority
Human, schedule, and upstream-agent origins are digest-bound. Selected financial and privileged actions fail closed without a traceable human intent id.
The limitation is part of the control
The influence manifest is supplied by the agent and a compromised agent can lie about it. Missing or malformed influence is therefore treated conservatively for consequential actions, and influence can never be the reason an action becomes allowed. Runtime isolation, credential custody, egress enforcement, and human review remain separate controls.