Dual LLM Pattern

Why it matters

Dual LLM contains injection blast radius. Understanding shapes secure design.

The architecture

Privileged: sees system + user (trusted).

Quarantined: processes emails, docs (untrusted).

Symbolic references between.

How it works end to end

Privileged: instructs quarantined.

Quarantined: returns symbols, not data.

Privileged decides actions on symbols.