Isolation as a First-Class Principle for LLM-Agent Safety: A Boundary-Centric Survey

Bottom line

Once an LLM agent becomes the 'brain' of a system, safety is no longer just input-output alignment—it's about system behavior and real execution outcomes. This survey unifies a fragmented attack surface under one principle: isolation.

Five boundaries

The authors propose a boundary-centric taxonomy where isolation lives at five interfaces:

• user ↔ agent
• agent ↔ tool
• agent ↔ execution
• agent ↔ agent
• system ↔ environment

Why it's useful

• Explains why prompt injection, tool misuse, and memory poisoning often share a root cause—a loss of isolation somewhere, propagating through the workflow.
• Helps locate where isolation first breaks, how compromise spreads across boundaries, and which defense fits each interface.
• Proposes an 'isolation-by-construction' research agenda.

For teams building agent systems and their security, this boundary framework is directly usable for threat modeling and defense selection.