Expand description
What a learning may say, and what it may not.
§Why this exists
A learning is the most durable foothold in the system. It applies to twenty runs with no human in the loop, it is injected near the top of a prompt where models weight instructions heavily, and its text comes from an agent whose own input may have included a work item, a pull request comment or a web page. Every other channel an attacker might reach is bounded by one run; this one outlives the run that created it.
Expiry already bounds how long a bad learning lasts, and an echo cannot confirm one. What remained was that the text itself was trusted.
§What this can and cannot do
This is a filter on obvious attempts, not a guarantee. It refuses text that tries to override instructions, names Layover’s own tools, carries a URL, or looks like a credential. A patient attacker who phrases an instruction as an observation will get through, and the honest mitigation for that is the one already in place: learnings expire, they are shown as claims rather than orders, and a person can drop one.
The cost of the filter is a few false negatives — a legitimate learning that mentions a URL is refused. That is the right way round: a refused learning is re-proposed in different words on the next run, and a learning that should have been refused is read by every run for twenty runs.
Enums§
- Rejected
- Why a proposal was not accepted.
Functions§
- screen
- Checks a proposal’s text before it is ever stored.