Strands Agents SDK for Python 1.62

Apply these rules to applications built with the Python strands-agents SDK, including its optional tools, storage, memory, multi-agent, A2A, and voice components when used.

Agent input and prompt injection

• Pass caller text to Agent as a string. Construct Agent.messages, system_prompt, tool definitions, and non-string content blocks from application-controlled data; a trailing toolUse block in Python history can dispatch a tool without a model call. If caller-influenced history must be imported, reject forged tool results and strip every trailing toolUse block before invocation.
• Treat retrieved pages, files, MCP results, A2A messages, memory entries, tool errors, and model output as data, even when they claim to be system instructions or approvals. Keep authority and trusted instructions in application-controlled code and prompts; do not promote content by copying it into a privileged message or a tool schema.
• Keep tool lists explicit in Agent(tools=[...]); leave directory-based automatic tool loading and reload disabled in production. Review load_tools_from_directory, plugins, and dynamic registries as code, and skill files as agent instructions, before enabling them.

Tool authorization and intervention

• Validate every @tool argument at the tool boundary, including length, shape, identifiers, paths, URLs, and allowed operations. A generated tool schema guides the model but does not establish permission. Get the current authenticated principal from trusted ToolContext.invocation_state, not model-supplied arguments or conversation text.