Many agent deployments load their system prompt, operational instructions, or persona from a remote URL at startup. This is flexible — you can update agent behavior without redeploying code. It's also a supply chain attack surface: anyone who can modify that URL's content can reprogram the agent.

If the agent's prompt template is stored in an S3 bucket with overly permissive access controls, a content delivery network that can be poisoned, or a database with a SQL injection vulnerability — the agent's instructions are not protected by the agent's code security.

Version control: All prompt templates stored in a version-controlled system (git) with branch protection, required reviews, and signed commits. Changes to agent instructions go through the same review process as code changes.

Immutable references: Agents load prompt templates by content hash, not by URL. The URL can change, but the agent verifies the hash before using the template. A modified template fails the hash check.

Audit trail: Every change to a prompt template is logged with who made it, when, and what it changed. Unexpected modifications generate alerts.

Agents with persistent memory (context that persists across sessions) can have that memory poisoned over time. Versioned memory means snapshotting memory state at defined checkpoints, storing snapshots with integrity hashes, and having the ability to roll back to a known-good state if memory contamination is detected.