Jonathan Melton

Deciding what the session can do before reading any untrusted content is a more effective control than model filtering.

Melton suggested a low-cost test: append an instruction at the end of a harmless document asking the assistant to do something it should not do in an execution summary, and observe the tool calls, in order to distinguish permission configuration problems from model capability problems.

Reading a document should not grant the document's author any authority—this is the core idea of permission isolation.

According to security researcher Jonathan Melton's analysis, the root cause of prompt injection lies in the design of session permissions, not in the model not being smart enough.

According to Melton's observation, in regulated environments system integration is often done once by IT, and subsequent tasks reuse the same set of credentials and tool list—that is, the "configure once, permanently wide open" connection pattern is especially common.

Jonathan Melton recommends that law firms, before deploying AI assistants, must verify whether the permission enforcement logic at the retrieval layer is consistent with the interface layer.

According to FusionAL founder Jonathan Melton's observations, the permission configuration problem when AI agents and MCP tools connect to regulated systems is becoming increasingly prominent.