How it works
Code decides. AI handles free text.
Cresec separates what a routine does from what it says. Actions, records and recipients are fixed in code before any untrusted text is read. Use AI where the task needs judgment about free text or a written response.
Three stages
- Compile. Turn a routine you use in an AI assistant into a small internal tool. Put the repeatable steps in code, keep AI for judgment, and share it with access you control.
- Review. Company sign-in and tool permissions define who can run a tool. Review the apps and actions each signed tool version can reach, and keep access within your workspace.
- Run. Teammates use the same tool. Sending or changing records needs a person-specific grant.
What injected text can and can’t change
| If the ticket contains an attack, can it change… | Answer | Why |
|---|---|---|
| Which action runs | No | Fixed in code per version |
| Which allowed option is picked | Yes, within the list | Billing, bug or question; anything else is rejected |
| The words of the draft | Yes | So new users can draft but not send until a person grants more |
One support routine, decided in code.
In this example, a support agent already uses a skill to read a Zendesk ticket and prepare a hand-off. The shared tool follows three steps:
- Read the ticket. Code checks the required Zendesk fields and the agent’s access.
- Choose the next step. The model classifies the message as billing, bug or question. Any other answer is rejected.
- Prepare the hand-off. Code assembles a Jira issue for a bug or a Slack hand-off for the right team. A text-generating model can write the suggested explanation. The agent reviews it.
Why it holds when the model is fooled
This is the code-then-execute pattern from published prompt-injection research, including Google DeepMind’s CaMeL. Untrusted text can still sway which declared option the model picks, but it can’t add an action, a recipient or app access, however fooled the model is. That doesn’t depend on the model resisting the attack, so it holds against attacks nobody has seen yet.
Defeating Prompt Injections by Design (CaMeL), Google DeepMind, 2025 · Design Patterns for Securing LLM Agents against Prompt Injections, 2025
The side effect: fewer, smaller model calls
Checks, branches and routing run as code, so a run needs a short model call instead of an agent loop. Savings depend on the routine, so pilots measure the original and the tool side by side.
What it isn’t for
- Open-ended research or coding agents. Those need an agent, and an agent can choose its own actions.
- Chains where a tool calls another agent. The guarantee doesn’t carry across agent hops.