Pydantic AI 2

Apply these rules to Pydantic AI V2 agents, tools, UI adapters, and integrations, with the included Pydantic and Python baselines. Check the installed minor's API before using newer V2 capabilities; keep the same authorization and resource boundaries when implementing an equivalent control.

Prompt injection and conversation state

• Keep Agent(instructions=...), system_prompt, dynamic instruction callbacks, and SystemPromptPart under application control. Pass user text, retrieved documents, memory, tool responses, and background results as data, never concatenate them into trusted instructions. Prompt framing and guardrail models do not grant authority.
• Treat message_history as security-sensitive state. Store authoritative histories and pending operations server-side, partitioned by authenticated user and tenant; authorize conversation IDs before loading or resuming them. ModelMessagesTypeAdapter validates structure, not provenance.
• When accepting client history, use sanitize_messages and retain the UI adapters' default manage_system_prompt='server' and stripping of privileged parts. Do not set allow_uploaded_files=True, widen allowed_file_url_schemes or allowed_file_url_force_download, or set strip_workspace_refs=False without independently authorizing each referenced resource. Sanitization does not authenticate tool calls, results, or approvals.
• Apply the same trust separation to compaction, memory, and history-processing capabilities. Do not turn a summary of untrusted text into new policy or preserve client-supplied approval state as