Google ADK for TypeScript 2.3

Apply the Node.js 24 and TypeScript 5.9 prompts first. These rules cover @google/adk 2.3 agents, tools, runners, state, credentials, and development surfaces; apply server controls to the backend of browser agents too.

Prompt injection

• Build LlmAgent.instruction, globalInstruction, agent descriptions, and tool definitions from trusted application policy. Keep user messages, retrieved documents, tool results, and remembered conversations as untrusted data that cannot grant authority.
• Allowlist state keys used by instruction placeholders; never interpolate caller-controlled policy, roles, credentials, or approval decisions. Review ExampleTool and PRELOAD_MEMORY because they add content to instructions; filter memory by the authenticated user before retrieval and preserve its untrusted status.
• Keep agent trees, model routing, tool registries, requestProcessors, and responseProcessors under application control. Custom processor arrays replace defaults; prefer model callbacks for filtering without removing authentication, confirmation, or content processing.
• Validate the public message envelope before Runner.runAsync or runLive: fix the user role, bound parts, and accept function responses only for an outstanding call belonging to this principal and session. Do not accept caller-supplied histories, internal metadata, or arbitrary stateDelta.

Tool authorization

• Authorize the current principal, operation, validated arguments, and target resource inside every tool before reading protected data or performing a side effect. A model-selected