Four security boundaries in an AI coding workflow

This note maps a coding-agent workflow across four security boundaries: the workspace, the model's context, the tools an agent can invoke, and the records used to investigate its actions.

Evidence label: source synthesis. This is an editorial synthesis of public guidance from OWASP and Microsoft. It does not report a Rechazo experiment, customer deployment, or original vulnerability finding. Each source is linked below.

Workspace boundary: what can enter

An agent may read project files, comments, logs, documentation, or fetched content as part of a coding task. Those sources can contain both useful data and instructions. A team should decide which projects are trusted, what the agent can read, and how external content is reviewed.

Evidence: Microsoft's VS Code security guidance describes workspace trust and restricted mode. OWASP's Secure Coding with AI guidance lists common indirect-injection sources in development workflows.

Context boundary: what influences decisions

Text from a file or tool response can influence later model behavior even when the user did not write it. Formatting, labels, or a previous approval do not make the returned content trustworthy. The context boundary is therefore a point to minimize and label data, but it is not by itself a reliable enforcement mechanism.

Evidence: OWASP's MCP security guidance treats tool descriptions and responses as possible injection surfaces and advises validating later actions independently.

Authority boundary: what can take effect

The security impact depends on the agent's tools, permissions, credentials, filesystem access, and network reach. Put authorization checks close to the operation that changes a system or transfers data. Use isolation and approval as layers, and verify which operations each layer actually covers.

Evidence: Microsoft's guidance documents tool permissions, sandboxing, MCP-server isolation, and the limits of those controls. OWASP recommends least privilege and action-specific approval in its AI Agent Security Cheat Sheet.

Evidence boundary: what the team can prove later

Logs help investigate actions, but a log is only useful when its coverage and trustworthiness are understood. Recording every prompt or payload can create another sensitive-data store. Decide which event fields are needed, protect them, and test that the expected actions appear in the record.

Evidence: OWASP's Logging Vocabulary guidance advises against logging full prompt and tool I/O where less sensitive event details can support investigation. Its third-party agent evidence guidance discusses how to assess records supplied by components outside your control.

What this map is for

Use these boundaries to review a deployment, assign control owners, and identify where a team has only model instructions instead of an enforced check. The map is a review aid, not a certification, product evaluation, or guarantee that an agent is secure.

Primary sources

• Microsoft: Secure AI-assisted development in VS Code
• OWASP Secure Coding with AI Cheat Sheet
• OWASP MCP Security Cheat Sheet
• OWASP AI Agent Security Cheat Sheet
• OWASP Logging Vocabulary Cheat Sheet
• OWASP Verifying Third-Party Agent Execution Evidence Cheat Sheet

Sources reviewed 25 October 2026. This note should be reviewed when the cited guidance changes materially.