CapScope: capability-scoped harnesses cut prompt-injection success to near zero

'Authority Is Not a String' derives task-level permission ceilings from trusted input and stores typed per-agent capabilities outside the model's context; every tool call is checked against the capabilities of the agent that issued it, so injected instructions can only execute what that agent was already allowed to do. On the Pi coding agent (300 runs; 5 tasks x 5 injection surfaces x 4 conditions): injected effects executed in 33-47 of 75 baseline runs versus 3/75 with CapScope, while repair completion stayed at 68/75 versus a baseline of 68-72/75.

Injection defense without asking the model to recognize malicious text: authority becomes typed, external and enforced at the harness layer. This is a directly implementable pattern for any team running tool-using agents against untrusted content — and a measured result showing security without capability loss.