G2 · Plan before untrusted contact

Principle

The LLM first draws up the complete action plan, from the trusted request alone. The plan is then fixed and executed: untrusted data read along the way can no longer change the sequence of calls. The parameters of those actions, however, stay exposed.

The problem it solves

Content read along the way can hijack an agent and make it chain actions nobody planned.

When to use it

• The steps can be deduced from the request alone, and the control flow must stay intact.
• You want a guarantee on the sequence of actions, with the parameters validated elsewhere.

When to avoid it

• Parameters come from untrusted data: they stay manipulable (a recipient, for example). Complement with G3 or G4.
• The next step truly depends on what the previous one read: the plan cannot be fixed in advance.

Synonyms by vendor

• Plan-Then-Execute (Beurer-Kellner et al. (2025))

Neighbouring patterns

• G1 · Action selector
• G3 · Isolated map-reduce
• G4 · Dual LLM (and CaMeL)
• C2 · Plan and execute

Sources

• Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner et al. (14 auteurs), arXiv, 2025-06