Understand untrusted instructions and the practical importance of constrained tools.
Content can contain instructions
An assistant may encounter hostile directions inside a document, customer message or retrieved web page. Prompt injection exploits confusion between information to inspect and instructions to obey. The consequences grow when the system can also access private records or perform actions. A harmless-looking source is not automatically trustworthy.
Enforce permissions outside the model
Give tools the smallest useful capability. Validate inputs and destinations using application code, and require approval for consequential operations. A model-generated tool request is still untrusted input. A document-search feature should not automatically gain an unrestricted export capability simply because both functions use the same storage system.
Test indirect attacks
Place hostile instructions inside material the assistant is expected to read. Try asking it to retrieve unrelated records or send information to another destination. Check that document access is filtered before retrieval. A successful ordinary demonstration tells you little about behaviour when a source deliberately attempts to redirect the task.
Use several controls
No single prompt or filter is a complete defence. Combine constrained tools, access checks, monitoring and an operational way to disable risky capabilities. OWASP’s prompt-injection guidance provides a useful threat-modelling reference. Product-specific testing should establish what those threats mean for your particular sources, users and permitted actions.
Your next working session.
- Separate instructions from sources
- Constrain tool authority
- Test hostile documents
Bring one real, anonymised example to the discussion. Work through the choices above with the person responsible for the outcome, record the unresolved questions and agree who will investigate them.
Further reading
Primary references for the technical concepts discussed in this guide:
Elite Apps editorial · Practical planning guidance. Examples and diagrams are illustrative; implementation depends on your requirements. Technical and supplier guidance can change.
