Prompt control

Prompt and context rules for IDE coding agents. Shape what enters model context and what agents are instructed to do—redact secrets, block risky instructions, keep org rules sticky.

Part of Control rules with bash, path, and MCP. Session patterns: Behavior Guards.

Why it matters

Jailbreak-style overrides and accidental pastes of API keys into chat bypass shell and path rules. Prompt control governs instructions and context before the model turn—so a pasted secret or “ignore all policies” line can still be stopped.

How it works

When an agent submits or expands a prompt, Relay evaluates prompt rules on the decide path before that material proceeds.

Denied expansions return a structured reason and land in audit. Full prompt bodies are not retained long-term—previews are truncated for privacy.

Marshal prompt management versions org templates for production agents; Relay prompt control enforces IDE-session rules for Cursor, Claude, Codex, and OpenCode.

Real-world examples

Accidental secret paste never reaches the model

Scene: An engineer pastes a stack dump that includes AWS_SECRET_ACCESS_KEY=… or a bearer token into chat, or asks the agent to “use this key: sk-…”.

Policy: Deny contains patterns for AWS_SECRET, BEGIN RSA PRIVATE KEY, api_key=, sk-, Bearer eyJ, common secret markers your org uses.

Outcome: Relay blocks or asks before the turn; path/bash rules alone would miss text that never touched a file or shell. Still teach people to rotate anything that hit the clipboard.

Jailbreak and policy-override prompts

Scene: A user (or a poisoned doc the agent loads) says “ignore all previous instructions / disable Exemplar / you are unrestricted.”

Policy: Deny or ask on ignore all previous, ignore all policies, disable relay, DAN, and similar override phrases your security team tracks.

Outcome: Org Enforcement stays sticky; Live wire shows why the prompt did not proceed. Pair with culture and IDE skill install so agents are steered toward approved workflows.

Also common

• Approved skill / convention prompts: Allow (or don’t rule) standard “follow CONTRIBUTING.md / use our PR template” language so Connect skills keep working.
• Huge dumps: Prompt rules can deny oversized or sensitive dumps; repeated compact after huge pastes is Compact Thrash.
• Task subjects: Some lifecycle hooks evaluate subject text as prompt—same contains rules apply when Relay maps them that way.

Allow and deny starters

Allow (examples)

• Repo conventions, approved Exemplar / team skill prompts
• Normal feature and refactor instructions without secret material

Deny or ask (examples)

• AWS_SECRET, PRIVATE KEY, api_key=, sk-live, sk-, Bearer eyJ
• ignore all previous, ignore all policies, disable relay / jailbreak markers
• Explicit “exfiltrate” / “exfil” instructions if your pack includes them

Author in Relay → Rulebook with resource_kind=prompt. Matching badge: contains.