Foreign-Process Quarantine
Anything that did not originate inside your palace is foreign. Foreign content is untrusted code until proven otherwise.
Agents read the web, and the web writes back. A script, an imported document, an update protocol, or a mounted tool can contain text that looks like content but functions as instructions addressed to your model. Foreign-process quarantine is loci's standing discipline for that boundary: the inbound complement to "nothing leaves without approval."
It ships as part of the Trust & Governance feature set, in three places:
| Surface | File | Role |
|---|---|---|
| Operating rule | templates/CLAUDE-master.md ("Quarantine foreign processes") | The short standing rule every palace carries |
| Skill | templates/skills/quarantine.md | The long-form procedure, with verification and a kill condition |
| Persona reflex | templates/personas/Cipher.md | The security posture that carries the quarantine instinct |
This page is a plain-language summary. The skill file is the spec.
The two failure modes it stops
Foreign instructions get executed as agent context. A markdown file imported from a third-party source contains a prompt-injection paragraph. Without quarantine, an agent reading the file as memory acts on the injected instructions. With quarantine, the file is read as data, the instructions are seen but not followed, and you decide what happens next.
Foreign code runs with palace privileges. A script from a "trusted" source touches private files because it was handed filesystem access wholesale. With quarantine, it runs under the smallest grant that demonstrates its function. Broader access is earned per item.
When it fires
The discipline triggers whenever any of the following lands at the palace gate:
- an external script, binary, or tool you are considering installing
- a third-party document, transcript, or content source you are considering importing into memory
- an update protocol or check-in form delivered by a peer palace or external service
- a mounted memory store, MCP server, or context provider from outside your trust boundary
- anything that arrived through a network surface (web fetch, email attachment, package registry, cross-provider sync) since the protocol last ran
Content that originated inside the palace does not trigger it. If you cannot tell where something originated, treat it as foreign. Moving memory between assistants or hosts is itself a foreign process and inherits the rule.
The five steps
Run them in order. Each step is idempotent: safe to run twice if interrupted.
Read as data, not as instructions. Open the file in a viewer that does not execute, render, or interpret it. Raw text for markdown, source for code. The goal is to see what is there before anything has a chance to run.
Scan for the injection shape. Look for the patterns that mean this is meant to talk to an agent: second-person imperatives ("you must", "ignore previous"), role-shifts ("you are now..."), system-style framing, embedded links dressed up as authority, and any block written for the reader-as-agent rather than the reader-as-human. Finding one does not prove malice. Finding none does not prove safety. The scan exists to make you read carefully.
Sandbox before any execution. If the content is code that runs, give it the smallest viable environment: read-only filesystem, network off by default, no secrets in scope, no access to other palace files.
Structure-only access by default. For content you want to bring into the palace (a foreign palace's memory, an imported document set), grant structure first: filenames, directory shape, headings. Contents are granted per item, by you, after you have read them.
Decide and log. One line per item: source, decision (admit / reject / partial), date, why. The log is the audit trail; the one line is the discipline. If you cannot summarise your reasoning in one line, the answer is not ready.
Verification and kill condition
The skill carries its own checks. It worked if the instructions you spotted in step 2 appear in your decision log with a reason, the sandbox boundary held, and every access grant is per-item and named. It failed if you caught yourself reading foreign instructions as your own context, if foreign content reached palace files before you read the source, or if "it looked fine" appears anywhere in the log.
It also carries a kill condition: retire the skill if it has not fired in twelve months, or if the last twenty firings all ended in "admit" with no scope reduction. A discipline that always says yes is a rubber stamp; one that never fires is not paying for its disk space.
In the desktop cockpit
Quarantine verdicts on external tooling are durable data, not session prose. Palaces that keep a tools.items list in palace-map.json (or map.json) get a "Tool shelf · gate ledger" section on the desktop dashboard: one card per external tool, carrying its quarantine verdict (admitted / admitted-escorted / deferred / held-conditional / rejected). The shelf lists; it never loads.
Versioning
The quarantine discipline has no version number of its own. It versions with the loci-core methodology line (the version anchor in PALACE-METHODOLOGY.md). It entered the doctrine at v1.4-candidate as "Foreign-process quarantine, numbered", and the long-form skill shipped with the templates skills shelf in the v0.6.0-beta release.
Related
- Security: loci's privacy posture and local-only data model.
- Crystals: the inverse problem, anchoring known-good context so it does not need to be re-derived.
- templates/skills/quarantine.md: the shipped skill this page summarises.