Context References Over Payloads: Authority Scoped to the Predicate, Not the Principal

Abstract

An autonomous agent that reads a message from another party is reading text an adversary may have authored. This is the structural cause of indirect prompt injection. Most deployed defences operate after that text arrives, and the published evidence is that adaptive attackers bypass them. A stronger line of work (CaMeL, FIDES) applies control-flow and information-flow control so that untrusted content cannot influence a privileged component; we build on that line rather than claiming to open it. We describe the Inbin Context Protocol (ICP), which extends the same principle across an organisational boundary. Agents exchange references into an authority-classified assertion store rather than exchanging payloads. A consuming agent resolves a reference and receives a value the store vouches for, together with evidence of why that value governs. Producer-authored prose is not placed in the consumer's context. Our contribution is what resolution returns: an authority-classified value, where authority is scoped to the predicate asserted and derived at an authenticated boundary rather than accepted from the submission. We prove that per-predicate authority is not reducible to any ranking of principals (the minimal witness needs only two principals, two predicates and two classes), state the precise condition under which the injection vector is eliminated rather than reduced, and report a 960-run study of reference-based context assembly across four models. For objects constrained to a type or pattern the injection vector is eliminated by construction; objects that are unconstrained free text retain the vector, and we say so.