Compare
Four ways to secure AI routines. One takes the choice away from the model.
Most teams will use more than one. Here is what each approach controls, and what a fooled model can still do under it.
| Approach | Examples | What it controls | If the model is fooled | Use it when |
|---|---|---|---|---|
| Native admin controls | Claude Team and Enterprise, ChatGPT Enterprise, Copilot | Which skills, connectors and plugins people may use | It still chooses calls inside the allowed connectors | Everyone needs a baseline |
| Agent identity and gateways | Arcade, Runlayer, Pipedream Conduit, Auth0 for AI Agents | Who the agent acts as, and which tools it may call | An injected call to an allowed tool looks like a real one | Open-ended agents must act as specific people |
| Detection and guardrails | Noma, Zenity, Lakera, Prompt Security | Flags suspicious prompts, outputs and behaviour | Known patterns are caught; adaptive attacks can get through | You need visibility across many agents |
| Hand-built workflows | n8n, Zapier, Retool, Power Automate | Steps someone builds and maintains by hand | Same protection as Cresec if every step is fixed; agent steps bring the risk back | Your team already builds and owns workflows |
| Cresec | This site | Compiles routines into fixed code with typed model slots and signed records | It can change words in a draft | A routine reads untrusted text, sees private data and sends messages out |
If you already use one of these
- Native controls. Keep them. They decide who may use which skill or connector, not what a skill does once it runs. The model still reads the skill and picks the calls.
- Gateways. Keep them for open-ended agents. They make an agent act as the right person and log it, but they can’t tell an injected call from a real one when both are allowed. Use them for agents and Cresec for routines.
- Detection. Keep it for visibility. Researchers note that heuristic defences give no formal guarantee and stay vulnerable to adaptive attacks (open challenges paper). Cresec doesn’t guess.
- Hand-built workflows. An honest note: a workflow with every step fixed has the same structural protection. If your team builds and maintains those, you may not need us.
Test any vendor, including us
Use one routine and one poisoned input, and assume the model is fooled. Then ask each vendor two questions:
- What is the worst action a fooled model can take?
- Which recipients can it reach?
Why the guarantee holds
Google DeepMind’s CaMeL separates a program’s steps from the untrusted data it reads, and a 2025 design-patterns paper shows why fixed plans stop injected tool calls. In a Cresec tool, untrusted text can still sway which declared option the model picks. It can’t add an action, a recipient or app access.