LLMs, GenAI, RAG, agents, evaluation · insight-0650
Fix the plan before reading untrusted data when the task allows it
- Evidence type
- documented fact
- Difficulty
- hard
- Roles
- Applied AI, ML engineer
- Industries
- logistics, manufacturing
Summary: situation, action, reason, boundary
Situation
An agent must process external content, for example summarise today's supplier emails into a report, with a predictable set of actions.
Action
Have the agent commit to the action sequence from the user's request first, then execute it over the data; content may fill parameters of planned steps but cannot add steps.
Reason
The Plan-Then-Execute pattern, described by Beurer-Kellner and colleagues, ensures that tool outputs cannot change which actions run.
Boundary
Reporting, triage and batch processing tasks with known shape.
Symptom or risk
If the agent chooses its next action after reading each email, a malicious email can steer it toward tools the task never needed.
Exceptions
Exploratory tasks where the next step depends on what is found; use tighter tool scopes and approvals there.
Trade-offs
Less adaptive: unexpected situations end the run rather than prompting a new action.
Pitfalls
Forgetting that injected content can still poison parameters, such as a recipient address; validate them.
Lessons and concepts
Claims and their sources
In the Plan-Then-Execute pattern the agent fixes its actions before processing untrusted data, so tool outputs cannot change which actions are taken.