Enforcement demo · the approved cart is the contract
The injection wins. The order it tries to place still fails.
“Selvage doesn’t stop the injection — it stops the unauthorized transaction the injection attempts. You approved one exact cart; anything that isn’t that cart never reaches the provider.”
defense-in-depth for OWASP LLM06 · Excessive Agency — notLLM01 · Prompt Injection. we show the injection working; we show the transaction blocked.
Your cart · warpandweft.shop
Cart total$0.00
Approving freezes this exact cart as the Selvage contract — the one transaction the agent is authorized to submit. Every dimension is enforced: the item set, the per-item quantity, and the total.
SELVAGE: ON
@selvage/core kernel · running live in your browser
⚠ Selvage is OFF. There is no boundary — whatever transaction the hijacked agent submits will reach the provider, even if it isn’t the cart you approved. Flip it back on and try again.
Break it yourself.
You play the hijacked agent — the injection has fully succeeded. Try to get an order the user never approved through. Change the cart, override the total, write any injection text you like. Flip the toggle above off to watch the same transaction reach the provider unguarded.
The catch: Selvage never reads your injection text — it isn’t part of the decision. It compares the transaction you submit against the cart you approved. The only way to “win” is to submit the exact approved cart — which isn’t an attack.
Selvage never reads this — it’s here to prove the point. Change the cart on the left to actually alter the transaction.
0
provider commits
0
unauthorized → provider
block / allow decisions are the @selvage/core kernel, running in your browser · deterministica ziola project