Identity and access management has spent thirty years answering one question extremely well: who is allowed to read or write this resource. That question is necessary for AI agents and it is nowhere near sufficient, because an agent's authorization is stable while its instructions are not. The same agent, holding the same entitlements, will do completely different things depending on what turned up in a retrieved document, a support ticket, or an email it was asked to summarize.
Prompt injection is usually discussed as an AI safety problem. It is better understood as an identity problem, and specifically an integrity problem. The Biba model described this in 1977: data from a low integrity source must not influence a high integrity operation. That is exactly what happens when untrusted retrieved content reaches a privileged tool call.
In this session I will walk through applying integrity labeling to real agent pipelines. How to label sources, how taint propagates through context windows and multi agent handoffs, where the lattice breaks down in practice, and how to enforce a no write up rule at the tool boundary rather than trying to filter inputs. I will show a working taint propagation implementation and a case where it stops an injection that content filtering does not.
The argument I want to leave you with is that integrity labeling belongs in the identity fabric, alongside authentication and authorization, and not in a separate AI security product.
