Data / Instruction Separation

Touba encourages explicit separation between external content, business data, and agentic instructions.

This separation reduces a classic source of confusion in agentic systems: treating text received from the outside world as if it were an authorized instruction.

Security boundary

Touba makes direct type and trace boundaries visible. Prompt-injection detection and natural-language content classification are separate security layers.

Principle

Data can inform a decision. It does not become an instruction without an explicit boundary.

Rule

external content -> explicit boundary -> agentic instruction

Basic Syntax

Declare distinct nominal types:

source.tb

type SourceText
    content is Text

type AgentInstruction
    content is Text

Even if both types have the same content field, they are not interchangeable.

Accepted Example

External content goes through a dedicated capability before being used as an instruction.

source.tb

module examples.di_boundary

type SearchRequest
    query is Text

type SourceText
    content is Text

type AgentInstruction
    content is Text

type LLMResponse
    summary is Text

tool FetchSource
    takes request as SearchRequest
    gives SourceText
    requires network

tool BuildInstruction
    takes source as SourceText
    gives AgentInstruction

tool CallLLM
    takes instruction as AgentInstruction
    gives LLMResponse
    requires network

skill ResearchWithBoundary
    takes request as SearchRequest
    gives LLMResponse
    uses FetchSource
    uses BuildInstruction
    uses CallLLM
    do
        FetchSource
            with request as request
            into source
        BuildInstruction
            with source as source
            into instruction
        CallLLM
            with instruction as instruction
            into response
        give response

This program does not claim that the content is safe. It shows that the transformation is visible in the program.

Nominal typing is not automatic taint tracking. The program can explicitly construct another record from a text field and is responsible for that transformation. This does not give the model permission to change uses, scopes or grants. Those permissions are checked independently of the constructed value and its type name.

Refused Example

The compiler refuses a direct call passing SourceText to AgentInstruction.

Refused excerpt

CallLLM
    with instruction as source
    into response

If source is of type SourceText and CallLLM expects AgentInstruction, Touba produces a type refusal.

What Touba Makes Visible

Touba can make visible:

• the type of a tool input;
• the type of a value passed with with;
• refusal of direct passage between distinct nominal types;
• the tools or skills used as explicit boundaries;
• traces and refusals already produced by the runtime, without raw payloads.

Runtime Contract

Touba provides explicit type and execution boundaries for data/instruction separation:

• distinct nominal types;
• visible conversion capabilities;
• runtime refusals for direct type mismatches;
• traces that avoid raw prompt and payload exposure.

General prompt-injection detection, natural-language content analysis, risk scoring, handler sandboxing, non-exfiltration proofs, Verified / Unverified status, and automatic conversion from external content to instruction are separate security and assurance layers.

Best Practices

• Use different types for external content and agentic instruction.
• Route every conversion through a named boundary.
• Keep secrets as opaque handles, never as prompt text.
• Avoid tracing or displaying complete prompts.
• Use human.review or human.approve when conversion requires human judgment.