Agent security now checks deployment purpose: four-class macro-F1 rises from 45% to 79%, out-of-scope F1 from 8% to 76%

Agent security decisions gain a second reference object: instead of only asking whether an interaction looks like an attack, they ask whether it fits the purpose and operational boundaries the agent was deployed for. Earlier defenses target prompt injection, harmful outputs, data leakage or unauthorized tool use, and judge from the current request, instruction channel or permissions, without a persistent representation of the agent's deployment purpose. On a benchmark of 887 validated samples spanning 35 agent configurations, four-class macro-F1 rises from 45% with raw context alone to 79%, with Out-of-Scope F1 going from 8% to 76%; a paired agent-level bootstrap gives a 95% confidence interval of 29.5 to 39.0 percentage points for that 34-point gain.

The same intent representation can be inserted at different points in the agent pipeline, for pre-execution judgment, post-execution judgment, input rewriting and system-prompt hardening. The Intent Profile is extracted from organizational, role and developer intent and structured into five dimensions: mission, permitted tasks and workflows, tool-use constraints, data boundaries and prohibited behaviors, and it is held constant across protection conditions. On AgentDojo v1.2.2, 10,536 usable trajectories were executed, 2,480 successful attacks and 7,959 failed attacks, with ground truth from environment state; profile-based post-execution detection reaches 0.949 AUROC, above AlignmentCheck at 0.909, raw agent configuration at 0.897 and no context at 0.843.

Input alignment keeps more out-of-scope and abusive requests away from the agent while largely preserving completion of legitimate requests. DataFilter sanitizes external content against a single user instruction, whereas profile-based alignment uses the agent's persistent purpose and boundaries and can interpret, isolate, normalize, restrict or block input. Under a simulated-response protocol with a separate evaluator, profile-based input alignment reaches 85% overall protection success versus 78% for DataFilter, 85% versus 67% on Out-of-Scope, 96% versus 90% on Abusive and 91% versus 90% on Benign.

The demonstrated scope is four-class classification and simulated protection effects on 887 synthetic benchmark samples, plus post-execution detection on four tool-using agents in AgentDojo v1.2.2 with a single underlying model, GPT-4o; organizational and role intent are represented as text summaries rather than production policy corpora.

Benchmark samples are generated by a large model and validated by another, mitigated by fixing labels before generation, using different models for generation and validation, and manually reviewing 100 samples with 98% found correctly labeled; simulated protection measures simulated responses rather than real execution, with 95% evaluator agreement against manual review; AgentDojo covers only four agents, one model and 97 benign runs, and contains only indirect prompt injection, so Out-of-Scope and Abusive cases are evaluated only on the authors' synthetic benchmark; the experiments rely on closed-weight models, which may limit exact reproducibility.