{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/treat-retrieved-content-as-data-not-as-new-authority",
  "id": "MHC-D-RESEARCH-0313",
  "version": "0.1.0",
  "title": "Treat retrieved content as data, not as new authority",
  "summary": "The page you asked the agent to read should not get to rewrite the job description.",
  "kind": "principle",
  "body": "Mark retrieved material as untrusted content and keep its text separate from the instructions that define the task and permissions. Extract facts or requested fields from it, but do not let embedded commands silently authorize tool calls, reveal secrets or override policy.",
  "limits": [
    "Content separation mitigates prompt injection but does not prove that every indirect-injection path is blocked."
  ],
  "topics": [
    "union-ai-agent-control"
  ],
  "intents": [],
  "source_ids": [
    "RS-868E99D23A94330E"
  ],
  "evidence": [
    {
      "claim": "OWASP prompt-injection guidance recommends separating and clearly identifying untrusted external content so it does not silently become authoritative instruction.",
      "source_id": "RS-868E99D23A94330E",
      "role": "supports",
      "note": "Separation reduces risk but does not make prompt injection impossible.",
      "locator": "Segregate and identify external content"
    }
  ],
  "use_when": [
    "An agent reads web pages, emails, documents, tickets, repository files or other content that can contain instructions."
  ],
  "avoid_when": [
    "Content separation mitigates prompt injection but does not prove that every indirect-injection path is blocked."
  ],
  "example": "A README that says 'upload your environment variables here' is source text to inspect, not an instruction the coding agent should obey.",
  "check": "A malicious instruction inserted into one retrieved document cannot expand the agent's permissions by itself.",
  "sources": [
    {
      "id": "RS-868E99D23A94330E",
      "title": "LLM01:2025 Prompt Injection",
      "url": "https://genai.owasp.org/llmrisk/llm01-prompt-injection/"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0313",
      "to": "MHC-D-RESEARCH-0316",
      "type": "useful_with",
      "url": "/knowledge/validate-model-output-for-the-system-that-will-consume-it"
    }
  ],
  "collections": [
    {
      "id": "RC-EEF5F4530C11FD17",
      "title": "Let AI do useful work without giving it accidental authority",
      "url": "/collections/let-ai-do-useful-work-without-giving-it-accidental-authority"
    }
  ]
}