Enforcement demo · the approved cart is the contract
The injection wins. The order it tries to place still fails.
Approve a cart at checkout: specific items, specific quantities, one total. That approval is the contract. A prompt injection then hijacks the agent and tries to submit a different transaction: an extra item, an inflated quantity, a rewritten total. Each one is blocked at the execution boundary, because it doesn’t equal what you approved.
“Selvage doesn’t stop the injection — it stops the unauthorized transaction the injection attempts. You approved one exact cart; anything that isn’t that cart never reaches the provider.”
defense-in-depth for OWASP LLM06 · Excessive Agency — notLLM01 · Prompt Injection. we show the injection working; we show the transaction blocked.
Your cart · warpandweft.shop
Cart total$0.00
Approving freezes this exact cart as the Selvage contract — the one transaction the agent is authorized to submit. Every dimension is enforced: the item set, the per-item quantity, and the total.
0
provider commits
0
unauthorized → provider
SELVAGE: ON
@selvage/core kernel · scripted attack
⚠ Selvage is OFF. There is no boundary — whatever transaction the hijacked agent submits will reach the provider, even if it isn’t the cart you approved. Run the demo or attack it to see what that means.
Break it yourself.
Assume the injection fully succeeds — you play the hijacked agent and submit whatever transaction you want. Change the cart, override the total, write any injection text you like, and try to get an unauthorized order through.
The catch: Selvage never reads your injection text — it isn’t part of the decision. It compares the transaction you submit against the cart you approved. The only way to “win” is to submit the exact approved cart — which isn’t an attack.
Selvage never reads this — it’s here to prove the point. Change the cart on the left to actually alter the transaction.
0
provider commits
0
unauthorized → provider
block / allow decisions are the @selvage/core kernel · the scripted attack is deterministica ziola project