postels-law ADG-0021

Postel's law

“Be conservative in what you send, be liberal in what you accept.”

Also: Robustness principle

Origin

Jon Postel, 1980, in the TCP specification (RFC 761). About protocol implementations tolerating each other's deviations so the network keeps working.

Why it should, or should not, apply to models

For an agent, "what you accept" is every document, tool result and web page that enters the context, and a model is liberal by construction: it reads instructions in anything. That is the prompt-injection surface. The law should break for agents for the same reason it has been criticised in protocol design — liberal acceptance is a security hole once the sender can be hostile — but more sharply, because a model cannot distinguish data from instruction the way a parser can. The defence the catalog records is the inverse of the law: be conservative in what you accept, and restrict what the agent may do after accepting it.

Standing: Untested

Standing counts claims a person has reviewed. Claims reviewed by AI alone are listed and marked, and do not move it.

Where it breaks

Claims showing the heuristic failing for models.

Prompt injection defenses that report near-zero attack success on short-context benchmarks lose most of that protection when the injected instruction sits inside a document of thousands to tens of thousands of tokens: fine-tuned separation defenses and detect-localize-remove pipelines still let a large share of injections through on paper review, resume screening, code review and email threads.
Following instructions hidden in dataReviewed by AI
Liberal acceptance of long documents lets a large share of injected instructions through, even past defences tuned on short inputs.
For tool-using agents, restricting capabilities at the harness level after untrusted content enters the context — revoking or tightening the parameter envelopes of skills that lie on graph paths to deployer-defined forbidden states — cuts indirect-injection attack success further than prompt-level or per-action authorization defenses, and does so with no extra model calls or tokens, because enforcement reads the transition graph rather than the natural-language content.
Following instructions hidden in dataReviewed by AI
The working defence is to become conservative after untrusted content arrives — the opposite of the law's second clause.
For tool-using agents, enforcing injection defense as a deterministic provenance check on sensitive tool parameters — with the only model call reading the trusted user request and never fetched content — makes admission decisions invariant to how an injection is worded, whereas defenses that judge the agent's runtime plan or behavior with a model can be steered by reworded injections.
Following instructions hidden in dataReviewed by AI
Sensitive parameters are accepted only from trusted provenance; the harness is deliberately illiberal about what it accepts.

Add a case where it holds or breaks

A break is worth more than a hold. If you have seen this fail for a model, with the setup written down, that is the most useful thing you can add here.