Preventing context poisoning through clean agent boundaries