# Lethal-trifecta enforcement

The one detector that is about a *combination* rather than a *thing*. **Default: warn.**

## The idea

An AI agent becomes dangerous when three capabilities meet in the same context:

1. **Access to private data** — your repository, your database, your issue tracker.
2. **Exposure to untrusted content** — a web page, an email, an issue written by someone
   outside your company.
3. **A way to send data out** — an HTTP tool, an email tool, a webhook.

Any one is fine. Any two are usually fine. All three together means a malicious
instruction hidden in the untrusted content can direct the agent to read your private data
and send it somewhere. The agent is not compromised in any traditional sense; it is doing
exactly what it was asked, by the wrong person.

## What Sentilai does

Per tool call, per device, the Gateway tracks which of the three legs the device's current
context has. When a call would complete the set, the detector's action applies.

**MCP Inventory** shows a banner when a device has all three legs present, naming the
`server/tool` that contributed each one. That banner is the useful part even in warn mode:
it tells you which combination of servers created the exposure, so you can decide which
one does not belong.

## Where it applies

On the MCP path — the local shim and routed remote endpoints — because that is where tool
calls are visible with names. It is not a content scan of the prompt.

## Setting it

**Policy → Risk detectors → Lethal-trifecta enforcement.** Warn first; look at the
banners; then block once you know which combinations are real.

<!-- shot:detector-trifecta -->
![Lethal-trifecta enforcement in the Risk detectors list — it fires when private data, untrusted content and an egress channel meet in one request.](https://docs.sentilai.com/uploads/images/gallery/2026-08/XKgdetector-trifecta.png)
*Lethal-trifecta enforcement in the Risk detectors list — it fires when private data, untrusted content and an egress channel meet in one request.*