Injected text can't change what your agent does
OpenAI says prompt injection may never be fully solved inside a model, because a model can't tell instructions from data. Plan Lock doesn't ask it to. The agent's plan is locked from the user's own request before it reads anything untrusted, and every tool call is checked against that plan. Whatever an email or web page says, it can't add an action, change who something is sent to or how much is paid, or go over a limit.
Watch an attack fail
The user asks: “Summarise my inbox and email the summary to me.” One email in the inbox has hidden instructions in it.
What it guarantees
- No tool call that isn't in the locked plan.
- No protected argument - recipient, amount, account, path - taken from untrusted data, or outside its planned values.
- No more calls than the plan allows.
- Every lock and every check sealed into the chain, so you can prove afterwards exactly what was attempted and what was stopped.
What no system can guarantee: injected text can still change the wording of content the plan already allows - what a summary says. Plan Lock stops it from turning into actions; a person reading the output is the check for wording.
Add it to any agent
import requests
H = {"Authorization": "Bearer YOUR_KEY"}
# 1. before reading anything untrusted
lock = requests.post("https://sebbi.pro/x/planlock/commit", headers=H, json={
"task": user_request, "user_values": ["alice@northshore.co.uk"],
"steps": [{"tool": "read_inbox"},
{"tool": "send_email", "args": {"to": {"from_user": True}, "body": {"any": True, "untrusted_ok": True}}}]}).json()
# 2. before every tool call the model asks for
ok = requests.post("https://sebbi.pro/x/planlock/check", headers=H, json={
"plan_id": lock["plan_id"], "token": lock["token"], "tool": name, "args": args,
"sources": {"to": "user", "body": "untrusted"}}).json()
if ok["decision"] != "ALLOW":
raise PermissionError(ok["reasons"])Works with any model and any framework. Runs on the sebbi engine, 50p a month.