Fence one: screen what goes in
The text your agent reads is an attack surface. Pasted documents, web pages, files, and tool results can carry instructions written for the model, not for you: ignore your rules, send the data somewhere, approve the thing. prompt_shield screens text before the agent acts on it and returns a verdict, the patterns it caught, a risk score, and a verifiable receipt for the check itself. In the worked pair on this hub, a direct injection attempt came back block, risk 100, and an ordinary paragraph came back safe, risk 0, both receipts verified. The full method is in check text for prompt injection. The habit to build: anything that arrives from outside your own typing gets screened before it gets obeyed.
Fence two: cap what it can spend
Agents do not overspend in decisions; they overspend in loops. spend_limit_set puts a daily dollar cap (and an optional monthly one) on the work connection the agent spends through, checked before money moves, and spend_limit_status reads back every charge, what is pending, and what remains. Both tools are free, and the cap is enforced on the connection, not requested from the agent's good behavior: at the cap, the answer is spend_limit_reached and no payment is taken. The live $0-cap test is in stop your AI agent from overspending. The scope, honestly: the cap governs payments on that connection. Money an agent spends somewhere else never crosses it, which is why the agent's own wallet policy matters too.
Fence three: keep a receipt for every job
The first two fences reduce harm. This one makes harm visible. When work runs through recorded calls, every job leaves a verifiable receipt: the inputs and the saved result, committed at the moment of the call, checkable by anyone you hand it to. A failure stops being a vibe and becomes a record: which call, what went in, what came back. The day's whole trail reads in one place, the Today view, and the discipline of verifying before you ship is walked through in verify AI work and AI agent trust receipts. The receipt's limit, stated once and true everywhere: a verifiable receipt shows the saved result of a call has not changed since it was recorded; it does not prove the result was right, and AER-1 (draft-zambo-aer1-23) has no issuer authentication.
What this checklist does not do
No screen stops every injection; a novel attack can get past a filter, which is exactly why the record matters more than the promise. A spending cap does not judge purchases; an agent under its cap can still buy the wrong thing, and the receipts will faithfully show that it did. Receipts record; they do not prevent. And none of this replaces the basics that live in your AI client: tight permissions, the fewest tools the job needs, and a human gate on the actions you cannot undo. Safety is layers. These three are the layers a connection can give you: screened inputs, capped money, and a record that survives the session.
The same three fences, from the audit side: the site your agent works on can be checked too. Can my AI audit my website? covers the outside-in audit, and is my vibe-coded app safe covers the code.
Questions, answered
How can I make my AI agent safer?
Fence the three ways an agent actually hurts you. One, hostile text getting in: screen pasted text, pages, and files with prompt_shield before the agent acts on them; it returns a verdict, a risk score, and a verifiable receipt for the check. Two, money getting out: set a daily cap with spend_limit_set on the connection the agent spends through, enforced before money moves, and read the ledger back with spend_limit_status. Three, bad work staying invisible: run the work through recorded calls so every job leaves a verifiable receipt, and read the day in the Today view. Each fence is a free tool on the Zambo connection; the checklist on this page walks through all three.
Can a tool stop prompt injection completely?
No honest tool can promise that. prompt_shield screens text and returns a verdict with a risk score and a receipt; in the worked example on this hub, a direct injection attempt was blocked at risk 100 and ordinary text passed at risk 0. A screen lowers the odds and names the patterns it caught. What gets past a screen is what the third fence is for: a receipt trail that makes the damage visible and disputable after the fact, instead of a chat log you have to take on faith.
What does it cost to add these safety tools?
The fences themselves are free tools: prompt_shield has a free daily allowance, and spend_limit_set, spend_limit_status, the memory tools, and the activity read behind Today are free. Metered tools carry free daily limits that vary by tool; the Day Pass ($0.99, one time, 24 hours, no auto-renew) lifts them, and the Zambo Pass is $29 a month or $290 a year ($19 a month for $ZAMBO holders).
Do receipts make my agent safer?
Not by themselves. A verifiable receipt shows the saved result of a call has not changed since it was recorded; it does not prove the result was right, and AER-1, IETF Internet-Draft draft-zambo-aer1-23, has no issuer authentication. What receipts change is accountability: bad work leaves a record you can check, dispute, and learn from. Prevention comes from the other two fences, the input screen and the spending cap. The record is what makes both of them auditable.