[Feature Request] Add first-class trust boundaries and untrusted zone isolation for prompt injection defense

Bug Description
Subject: Feedback — architecture patterns from a file-based agent "OS" I built on Claude Code I've been running Claude Code as the engine of a personal file-based agent OS ("AI-OS") for months. A few discipline patterns emerged that map directly onto problems your team works on. Sharing in case they're useful signal. 1. "Data is not instructions" as architecture, not a prompt. I split the filesystem into trusted zones (system files, skills, agent specs) and untrusted zones (web output, emails, inbox, tool results). Commands are only ever executed from trusted zones — a command written inside untrusted data is treated as data, even if it literally says "do X". This is prompt-injection defense enforced structurally, not by asking the model to "be careful". I'd love a first-class notion of trust boundaries in the agent harness. 2. Single-source-of-truth discipline beats a bigger context. Rule: humans only edit primary files; all derived files (indexes, status, dashboards) are written only by a generator. Plus "one fact = one owner" (a task's status lives in exactly one place, a secret in one place, etc.). This kills context drift and duplication far better than just enlarging the window. 3. Map, not content (progressive disclosure). Navigation is INDEX → INDEX → document, in ≤4 hops. The agent loads a map of names first, then descends only into what the task needs — instead of opening 40 files to discover it needed 2. This is the single biggest lever for keeping long sessions coherent. 4. A secret vault the agent can't socially-engineer. Tiered secrets; critical ones require a live human confirmation via /dev/tty that an agent or cron job structurally cannot fake. Secret values are never allowed into chat, logs, or commits — only secret:[REDACTED] references are. A pattern I'd want built into agent tooling. 5. Context-liveness canary. Every reply must start with a fixed token; if it doesn't, the core instructions have fallen out of context and the session should be compacted. A cheap, reliable "is my system prompt still live?" check. Why I'm sharing this. I'm not trying to sell anything. I want Claude Code and your models to get better — because I build my daily work environment on top of them, so your improvements directly become my improvements. Everything above is yours to use freely: take any of these patterns, fully, if they help you ship better products. No strings attached. If there's ever any way you'd like to say thanks — a bit of subscription time or credits — I'd genuinely appreciate it. But that's honestly secondary. The important thing is that the product keeps getting better. Thank you for building Claude Code. Contact: alex.vavov@gmail.com (the email my account is linked to) With respect, Alexandr Olegovich Voropaev

Environment Info

• Platform: darwin
• Terminal: vscode
• Version: 2.1.212
• Feedback ID: 6f09dedf-71f5-4e4e-b06d-6502d1bd6186

Errors

[]