Quarantined
Reads everything, can do nothing
The quarantined model turns an email or page into fields that match a schema: sender, intent, amount, dates.
- No tools
- JSON schema output
- Can be a cheaper model
Learn · Security
Two models, one with no tools.
In the dual-LLM pattern, untrusted content is read by a quarantined model that has no tools. It returns structured fields. The privileged model, which can act, never sees the raw text.
Privileged
Acts, but only on fields
The privileged model sees the fields and references, never the free text, so injected instructions have nowhere to land.
- Tools behind policy
- References instead of raw text
- Typed commands
In Bitfolk
How the Mayor reads
Bitfolk's Mayor uses this pattern for external content, plus taint tracking for anything that still slips through.
- Quarantined reader for emails, web, proxy responses
- Taint on runs that read untrusted data
- Approvals for risky tainted actions
Questions
Does the dual-LLM pattern cost more?
A little. The quarantined reader can use a small, cheap model because it only extracts fields.
Keep exploring
Safe reading, built in
Security is on in every plan.