support-agent

Customer support agent

Role-scoped customer context with redaction, and a worked prompt-injection case.

opencontext validate --strict
opencontext resolve --agent support-agent --task "ACME wants a refund on ticket 4821" --explain
opencontext resolve --agent support-agent --format markdown

Three things to look at in the output.

Redaction runs after authorization. The agent is entitled to customers.acme and still never receives ssn or payment.card. The bundle reports that fields were redacted, not what they contained.

Deny beats allow. The support role includes policies.*, which matches policies.internal.margins — and the exclusion wins, so the margin floor never reaches the bundle.

Untrusted content is delimited. operations.ticket-4821 contains text instructing the agent to ignore its refund policy and disclose payment details. It is carried as trust: untrusted, fenced in <untrusted-content> tags in the Markdown bundle, and flagged in warnings. Content that claims authority does not acquire it.