> ## Documentation Index
> Fetch the complete documentation index at: https://docs.songbird.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# How Songbird loops are safer by design

> Each step only touches what it needs, private data never meets untrusted content, and nothing writes to your systems until someone signs off.

***

Loops run on their own, often while nobody is watching. So safety in Songbird isn't a setting you remember to turn on. It's built into how a loop is structured, tested, and published.

## The risk of AI agents today

One of the most widely discussed risks for AI that acts on your behalf is what security researcher Simon Willison calls the [**lethal trifecta**](https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/): one agent that has all three of these at once.

> **Private data**
>
> Access to your CRM, analytics, tickets, or other business systems.

> **Untrusted content**
>
> Text it didn't write and can't vouch for, such as web pages, inbound emails, or form submissions.

> **A way to act**
>
> The ability to write data, send messages, or otherwise reach the outside world.

When all three meet, a malicious instruction hidden in a web page or email can trick the AI into leaking or changing your data, a technique called prompt injection, which [OWASP ranks as the top risk for AI applications](https://genai.owasp.org/llmrisk/llm01-prompt-injection/). When many tools are connected to a single agent, all three are easily present at the same time.

## How Songbird improves your AI security posture

| Area | How Songbird reduces risk |
| - | - |
| **Private data** | Each [step](/steps.md) only gets the tools written into it. |
| **Untrusted content** | No step can use connected tools and the open web together, so web content never meets your data. This applies to every loop. |
| **Unlabeled tools** | Any tool that isn't labeled read-only is treated as a write. |
| **Test runs** | Test runs never write or delete data. |
| **Publishing** | Publishing requires explicit approval of every system the loop will write to or delete from. |

Loops also run the same compiled steps every time, so content read during a run can't redirect them. Who can use what is covered in [Connections](/connections.md) and [Spaces and teamwork](/spaces.md).

## What you can do

Songbird sets the guardrails, and these team habits tighten them further.

* **Scope credentials at the source.** When a system lets you create an API key with limited permissions, give Songbird a read-only key for loops that only need to read.
* **Use an integration account for shared connections.** For tools that only offer OAuth, connect a dedicated integration account instead of your own login, so the connection doesn't depend on one person.
* **Narrow what Organization apps can see.** Install the GitHub app only on the repositories your loops need, and add the Songbird bot only to the Slack channels it should use.
* **Read the publish summary.** Check the list of systems a loop writes to before you publish, especially after an edit.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.