Stage 3: safe in production.
Ten strictly defensive patterns for the failures that actually burn operators — prompt injection, leaked secrets, runaway spend, silent tool misuse, exfiltration, and actions nobody can trace back afterward. Plain Python. No API key. Not slideware — working code.
Complements the Loop Engineering library at the system level — Loop governs how one agent loop runs; this governs what any number of loops are allowed to do, spend, touch, and ship.
Watch free. Run instantly. Own forever.
Watch
The daily build-in-public series on the AIS YouTube channel walks the reasoning behind each defensive pattern, free.
Run
Unzip the library and run any pattern instantly: pure Python 3.10+, stdlib only, no API key. A deterministic mock model is included; every pattern ships with its test.
Own
Plug your real LLM client into one file, copy the pattern folders into your project, and keep them forever.
Which file do I run?
Each hpNN-* folder is fully independent — no shared install, no config, no
setup step. Two files per folder, always the same shape.
- · The pattern file (e.g.
injection_quarantine.py) is a runnable demo — it walks through the failure mode and shows the defense actively blocking the attack: refused calls, redacted secrets, tripped ceilings, halted loops, held sends. - · The test file (
test_injection_quarantine.py) is the proof battery — it asserts the attack fails and the legitimate path still works.
Read the module docstring first — it explains the defense, the attack it stops, and why the obvious naive version breaks. Copy the folder into your own project as-is; the guard logic is the part worth keeping unmodified.
What’s in the library
Agent systems fail in a small number of predictable ways, and almost none of them are "the model was dumb." They’re missing chokepoints — no gate between the agent and its tools, no ceiling on spend, no record of what happened, no way to stop it. This library is ten of those chokepoints, each a standalone, working pattern.
Strictly defensive: it hardens the boundary between an agent and the real world — tools, money, secrets, the filesystem, the network, deploys. It does not implement agent reasoning or task logic; that’s what Loop Engineering and Graph Engineering are for.
# no install, no dependencies, no API key cd hp01-injection-quarantine python injection_quarantine.py # watch the defense block the attack python test_injection_quarantine.py # prove it holds under adversarial input # then plug YOUR model into one file (core/model.py) # and copy the folder into your project
Injection quarantine
Untrusted content is wrapped in a content-hashed, unforgeable boundary and labeled DATA, never instructions.
hp01-injection-quarantine/
Tool permission gates
Per-role tool allowlists by tier — read, write, execute, destructive, financial — with single-use, per-call approval tokens.
hp02-tool-permission-gates/
I/O guardrails
Input validation before the model sees anything; output checks against schema and business rules, with one bounded repair before escalation.
hp03-io-guardrails/
Secret hygiene
A redactor scans every outbound text — logs, prompts, outputs — for secret-shaped substrings; a planted canary proves nothing leaks unredacted.
hp04-secret-hygiene/
Spend ceilings
A shared spend ledger with hard per-task and per-day dollar and token ceilings, a cheaper-model downgrade path, and staged 50/80/100% alerts.
hp05-spend-ceilings/
Kill switch
An operator-controlled STOP/PAUSE file polled at every atomic step boundary, plus watchdog and health-guard auto-triggers on the same halt path.
hp06-kill-switch/
Audit log
An append-only, hash-chained log — every record links to the previous record’s exact hash; sensitive args are digested, never stored raw.
hp07-audit-log/
Sandbox boundaries
A guarded filesystem/command facade: paths resolved before the verdict, allowlisted write dirs with size caps, commands only as argv lists on an allowlist.
hp08-sandbox-boundaries/
Exfiltration guards
One egress gate on every outbound channel: destination allowlist, PII scan, secret scan, and payload-size anomaly check, with holds routed to review.
hp09-exfiltration-guards/
Canary rollback
Versioned prompt/model configs shipped to a deterministic canary slice, scored against baseline, with automatic rollback plus an incident record on degradation.
hp10-canary-rollback/
Where it sits
Ship it and hope
- · No gate between the agent and its tools
- · No ceiling on spend, no kill switch
- · Nobody can trace what happened afterward
Agentic Systems Hardening Library
$129 · one-time- · Ten defensive chokepoints, implemented + tested
- · Runs offline — stdlib only, no API key
- · Strictly defensive — hardens the boundary, not the reasoning
- · Complements Loop Engineering at the system level
Enterprise AI-governance platforms
- · Sales call to see pricing
- · Black-box policy engine
- · Locks your data into their cloud
Get the library
$129 · one-time, no subscription
- ✓ All ten defensive chokepoints, implemented + tested
- ✓ Pure Python 3.10+ · stdlib only · no API key
- ✓ Mock model included — swap in your real client in one file
- ✓ Strictly defensive: no offensive tooling, no exploit code
- ✓ Email support at [email protected]
Want the whole stack?
The Complete Stack bundles Loop, Graph, and Hardening — every pattern across all three libraries — in one download, for $199.
Buy the Complete Stack — $199 →