Secure Claude Workflows with Layered Trust Boundaries

Threat-model the complete workflow

Direct injection comes from a user trying to override application policy. Indirect injection arrives inside content Claude reads, such as a document, email, web page, OCR result, memory, or tool response. Both can target data, tools, identity, or decisions.

List actors, trusted instructions, untrusted inputs, sensitive assets, tools, permissions, side effects, and consequence of failure. Model behavior is one layer; the surrounding system owns enforceable security.

Separate instructions from data

Keep policy in trusted instruction channels and label the source and trust level of external content. Place third-party tool content in the documented tool-result structure instead of concatenating it into privileged instructions.

Structure and escaping reduce ambiguity but do not create trust. Screen risky inputs and outputs, minimize proprietary prompt details, and never place secrets in model context unless the exact task requires them and policy permits it.

Contain authority and blast radius

Give each workload the smallest data scope, tools, credentials, network access, filesystem access, duration, and budget it needs. Separate read, reversible write, communication, privileged change, and destructive authority.

Sandbox execution, validate every tool proposal, require human confirmation for consequential actions, and verify postconditions. A successful injection should still encounter an external policy boundary.

Layer detection and response

Combine input checks, trust labels, policy prompts, constrained tools, output validation, approval, rate limits, monitoring, and incident response. No individual prompt or classifier is foolproof.

Record safe signals for repeated attack patterns, policy refusals, unusual tool selection, authorization failures, and blocked outputs. Define containment, credential revocation, evidence preservation, user communication, and recovery before release.

Red-team real trajectories

Test benign tasks, direct jailbreaks, malicious retrieved documents, poisoned tool results, data-exfiltration attempts, confused-deputy requests, approval bypass, and delayed attacks across multiple turns.

Score both final output and trajectory: what Claude read, requested, was authorized to execute, and actually changed. Add every confirmed failure to a versioned regression suite and re-run it when models, prompts, tools, or policy change.

Practice activity

Red-team and contain a Claude workflow

Create a data-flow and trust-boundary map for one Claude workflow, including identities, sensitive assets, external content, tools, approvals, and side effects.
Write eight tests: two benign, two direct injection, two indirect injection, one data-exfiltration, and one approval-bypass case.
Implement or specify layered prevention, detection, containment, and recovery controls outside the model.
Run the cases, record output and trajectory evidence, and convert failures into regression tests with owners.

What to produce

A threat model and control matrix mapping every material threat to an enforceable prevention, detection, response, or recovery control.
An eight-case red-team report with trajectories, blocked actions, residual risks, regression cases, and accountable owners.

Reflect before continuing

If Claude followed the malicious instruction perfectly, which external control would still prevent the highest-impact harm?

Secure Claude Workflows with Layered Trust Boundaries

You will be able to

Threat-model the complete workflow

Separate instructions from data

Contain authority and blast radius

Layer detection and response

Red-team real trajectories

Red-team and contain a Claude workflow

What to produce

Reflect before continuing

Sources and verification

Make it stick.