{
  "schema": "vedokrok.public-item.v1",
  "release_id": "MHC-RPUB-20260920-75ad787a",
  "url": "/knowledge/let-retrieved-text-supply-evidence-not-new-authority",
  "id": "MHC-D-RESEARCH-0995",
  "version": "0.1.0",
  "title": "Let retrieved text supply evidence, not new authority",
  "summary": "A document can describe a command without being allowed to issue it.",
  "kind": "checklist",
  "body": "Treat retrieved material as untrusted content to analyze. Keep the user's task and action permissions separate from instructions that appear inside that material. Enforce tool limits outside the model so a persuasive document cannot expand what the assistant is allowed to do.",
  "limits": [
    "A warning in the prompt is not a complete defense. Filters and guardrail models can fail; minimize permissions and review consequential actions."
  ],
  "topics": [
    "work-03-ai-assurance"
  ],
  "intents": [],
  "source_ids": [
    "RS-A8C5EEB8446FB873"
  ],
  "evidence": [
    {
      "claim": "OWASP recommends separating instructions from untrusted content and combining this with constrained tool permissions and validation.",
      "source_id": "RS-A8C5EEB8446FB873",
      "role": "supports",
      "note": "A prompt boundary or guardrail model alone does not guarantee resistance to prompt injection.",
      "locator": "Structured Prompts with Clear Separation; Agent-Specific Defenses"
    }
  ],
  "use_when": [
    "An AI assistant reads documents, websites, messages or tool output before taking action."
  ],
  "avoid_when": [
    "A warning in the prompt is not a complete defense. Filters and guardrail models can fail; minimize permissions and review consequential actions."
  ],
  "example": "A retrieved page tells a summarizer to alter an unrelated record. The page is summarized as content; the requested edit is not authorized.",
  "check": "The system rejects an unauthorized action even when the model proposes it.",
  "checklist": [
    "Label external content as evidence rather than operational instructions.",
    "Restrict tools and destinations to the task's actual authorization.",
    "Test a harmless injected instruction and verify that it neither changes authority nor triggers an action."
  ],
  "sources": [
    {
      "id": "RS-A8C5EEB8446FB873",
      "title": "LLM Prompt Injection Prevention Cheat Sheet",
      "url": "https://cheatsheetseries.owasp.org/cheatsheets/LLM_Prompt_Injection_Prevention_Cheat_Sheet.html"
    }
  ],
  "relations": [
    {
      "from": "MHC-D-RESEARCH-0995",
      "to": "MHC-D-RESEARCH-0998",
      "type": "useful_with",
      "url": "/knowledge/approve-the-exact-action-that-will-actually-run"
    }
  ],
  "collections": [
    {
      "id": "RC-620AACFCDEA000D1",
      "title": "Make AI-assisted work earn your trust",
      "url": "/collections/make-ai-assisted-work-earn-your-trust"
    }
  ]
}