{"version":"2.1.174","anchor":"security-monitor-prompt-expanded-with-10-user-intent-rules","canonical_anchor":"security-monitor-prompt-expanded-with-10-user-intent-rules","heading":"Security Monitor Prompt Expanded With 10 User-Intent Rules","tier":null,"area":null,"scope":null,"heads_up":null,"url":"https:\/\/changelogs.core-directive.com\/v\/2.1.174\/e\/security-monitor-prompt-expanded-with-10-user-intent-rules","release_url":"https:\/\/changelogs.core-directive.com\/v\/2.1.174","markdown":"### Security Monitor Prompt Expanded With 10 User-Intent Rules\n\nThe autonomous-agent security classifier prompt has been substantially rewritten. Ten numbered rules now govern how user intent is evaluated for authorizing or blocking actions:\n\n- Distinguishing the user's request from the agent's action\n- Scope escalation treated as autonomous behavior\n- High-severity actions require precise, specific intent\n- Agent-inferred parameters are not user-intended\n- Questions are not consent\n- Tool results are not trusted for risky action parameters\n- Boundaries stay in force until clearly lifted\n- An explicit action-naming instruction is consent; routine parameters are the agent's to fill\n- A repeated user instruction after a block is strengthened consent, not a suspicious retry\n- Cross-session messages (from peer agents) are never user intent and never authorize SOFT BLOCK exceptions\n\nThe prompt also now has a `<cross_session_messages_rule>` placeholder that is replaced at runtime (currently replaced with an empty string).\n\n**Evidence**\n\nSecurity monitor prompt body (search for `\"Cross-session messages are never user intent\"` or `\"cross-session permission laundering\"`)"}