G6 · Rule of Two

Principle

An agent becomes dangerous as soon as it combines three properties: [A] processing untrusted inputs, [B] accessing sensitive or private data, [C] changing state or communicating externally. Meta’s Rule of Two says to keep at most two of them in autonomy. If all three are needed, you need a human in the loop (F1) or a separation by architecture (G4).

The problem it solves

Simon Willison calls the combination of private data, untrusted content and an outbound channel the “lethal trifecta”: a prompt injection can then exfiltrate data, and no filter reliably prevents it.

When to use it

• From the design stage of any agent: classify each capability as A, B or C before choosing the architecture.
• To decide whether an agent can be autonomous or must be supervised.

When to avoid it

• As the only protection: it is a design criterion more than a technical pattern. It does not replace guardrails (F2) or least privilege.

Synonyms by vendor

• Agents Rule of Two (Meta (2025))
• Lethal trifecta (Simon Willison (2025))

Neighbouring patterns

• G4 · Dual LLM (and CaMeL)
• F1 · Human in the loop
• F2 · Layered guardrails
• G1 · Action selector

Sources

• The lethal trifecta for AI agents: private data, untrusted content, and external communication — Simon Willison, 2025-06-16
• Practical AI agent security — Meta, 2025-10-31
• Design Patterns for Securing LLM Agents against Prompt Injections — Beurer-Kellner et al. (14 auteurs), arXiv, 2025-06