G1 · Action selector

Principle

The LLM translates the request into one action from a closed list. The action runs without its result going back to the model. Since nothing external flows back through the LLM, booby-trapped content has no path to influence it.

The problem it solves

As soon as an agent reads back what its tools return, booby-trapped content can dictate what it does next.

When to use it

• The agent only has a small number of predictable actions to trigger, and security comes before flexibility.
• You want maximum security, even if the model is vulnerable to prompt injection.

When to avoid it

• Usefulness matters: this is the pattern with maximum security and minimum utility. The agent can neither reason over results nor chain free-form steps. Prefer a fixed plan (G2) or a dual LLM (G4).

Synonyms by vendor

• Action-Selector (Beurer-Kellner et al. (2025))

Neighbouring patterns

• G2 · Plan before untrusted contact
• G4 · Dual LLM (and CaMeL)
• G6 · Rule of Two
• F2 · Layered guardrails

Sources

• Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner et al. (14 auteurs), arXiv, 2025-06
• The lethal trifecta for AI agents: private data, untrusted content, and external communication — Simon Willison, 2025-06-16