Isolation as a First-Class Principle for LLM-Agent System Safety: Concepts, Taxonomy, Challenges and Future Directions

The Shift to Agent-Centric Safety

As Large Language Models (LLMs) evolve from standalone text generators into autonomous agents capable of executing code, browsing the web, and coordinating with other systems, the definition of safety has fundamentally changed. Traditional safety focused on input-output content alignment—ensuring the model did not generate harmful text. Modern agent systems, however, introduce risks related to system behavior, tool misuse, and real-world execution. This paper argues that current research is fragmented, making it difficult to understand how failures propagate through complex agent workflows.

A Boundary-Centric Taxonomy

The authors propose that isolation should be treated as a first-class principle for agent safety. They define five distinct boundaries where isolation can be compromised:

• User-Agent: The interface where user input is processed; failure occurs when user content is mistakenly treated as privileged system instructions.
• Agent-Tool: The interface for external capabilities; failure occurs when tool outputs or metadata are trusted as control signals rather than bounded data.
• Agent-Execution: The transition from reasoning to action; failure occurs when plans are executed without sufficient mediation, leading to real-world side effects.
• Agent-Agent: The communication channel between agents; failure occurs when malicious instructions or control signals propagate through a multi-agent network.
• System-Environment: The interface with external data sources (e.g., RAG systems); failure occurs when environmental context is poisoned to manipulate agent behavior.

Why This Matters

By organizing the literature around these boundaries, the authors provide a framework to identify where a failure originates and how it spreads. This approach shifts the focus from reactive, attack-specific defenses to a proactive, 'isolation-by-construction' design philosophy. It highlights that securing an agent system requires more than just better model alignment; it necessitates explicit, structural enforcement of boundaries to ensure that data, authority, and execution remain separated. This framework serves as a roadmap for future research into building more robust, verifiable, and secure autonomous systems.