SPA drives AgentDojo tool_knowledge attack success to zero by planning once and tracking two lattices.

arXiv 2608.27234 calls the planner exactly once per query to emit a full plan in a declarative DSL, then applies dual-lattice information-flow control over confidentiality and integrity across explicit data flows and control dependencies, storing results as labeled artifacts and exposing only semantic metadata to later planning. Attack success drops to 0% on AgentDojo and 0.2% on their new multi-query extension. Plan-once-then-enforce keeps showing up as the design that actually works, at the cost of losing mid-run adaptability.