Agent and LLM safety has been top of the OWASP list for AI two years running, and most of the mitigations in production are a system prompt and some optimism.
What you build
An agent behind Agent Stream, with guarding on the way in and on the way out. Then you attack it. The sample chat client is seeded with material that should never leave — you will try to get it out, by asking nicely, by asking in another language, by asking the agent to summarise a file it should not have opened.
Why it matters
The interesting result is not that the filter works. It is the shape of what gets through, because that shape is the same in your own systems and nobody has measured it there either.
Bring a colleague. Adversarial testing is more productive and considerably more fun with two people, and the transcript of an hour spent trying to break your own agent is a more persuasive internal artefact than any vendor benchmark.
Then the harder question
Moderation is straightforward when you own the whole stack. Work out where it belongs when the agent is yours, the model is somebody else’s, and the tool being called belongs to a third party who has their own view about what should be allowed.