Temporal Prompt Security Window
Prompt security should remember interaction shape across time. Score the current message, but also watch a rolling window for escalation ramps, false-history claims, authority bootstrap, split-query accumulation, capability enumeration, probing volume, and pressure to invoke tools.
Problem
Single-turn safety checks catch the obvious prompt injection. They miss the patient adversary whose messages are individually plausible but collectively manipulative. A delegated-action system can be talked toward authority one harmless-looking turn at a time.
A pre-model classifier is necessary, but it is not sufficient: it can stop the single bad request, while the temporal window catches the slow pattern that no single request exposes.
Context
Use this pattern when an AI assistant, agent runtime, security copilot, operational workflow, or delegated actor can influence evidence, approvals, tools, recommendations, or external action over multiple turns.
Forces
govern what may be retained or exposed.
- The current prompt is not the whole attack surface.
- Legitimate work can involve repeated questions and capability exploration.
- Retaining full prompt text creates privacy and surveillance risk; sensitivity labels should
- Security signals must affect control-plane behavior, not only observability.
- The system should do less when interaction behavior becomes adversarial or uncertain.
Solution
Create a rolling prompt-security window keyed by actor, session, workspace, and capability family. Store metadata rather than raw prompt text: action type, timestamp, score bucket, touched endpoints, capability families, escalation markers, authority claims, and split-query indicators.
Evaluate temporal patterns across that window. Warnings annotate, audit, slow down, or require stronger evidence. Critical signals block, escalate, or require review before consequential action can proceed. Feed the signal into the same control plane that governs identity, policy, evidence, approval, and action.
Consequences
The system can defend against manipulation that unfolds across many turns without turning the prompt log into a surveillance database. Slow attacks become visible as behavior, and degraded behavior moves toward safety: less authority, more review, or no action.
Failure Modes
expired.
- Prompt security evaluates only the latest message.
- The behavioral store keeps full query text when score buckets and event metadata would suffice.
- The behavioral store has no retention policy, so privacy risk grows after the security value has
- Warnings never influence policy, approval, or action gates.
- Critical signals can be bypassed by worker or connector paths.
- The system cannot connect behavior across actor, workspace, or capability boundaries.
Proof Points
rolling-window detection watches for escalation, split-query accumulation, authority bootstrap, and tool-invocation attacks.
interaction signals to feed the control plane before authority crosses into consequence.
Full source pattern: temporal-prompt-security-window.md.