Principle
Enforce permissions outside the model
A sentence in a prompt is guidance. An authorization check is a control.
When it fits
- A workflow relies on prompt instructions such as 'never access other users' data' or 'only admins may delete.'
When to avoid it
- Deterministic authorization still needs correct policy, testing, auditability and secure identity handling.
Why it matters
Put access rules in deterministic downstream code or policy enforcement points that validate every protected request. The model can help choose an action, but it should not be the component that decides whether the caller is allowed to perform it.
An example
A delete API checks the user's role and record scope even when the agent confidently claims the deletion is allowed.
Check your result
Changing or bypassing the model prompt cannot bypass the downstream authorization rule.
Keep this limit in mind
- Deterministic authorization still needs correct policy, testing, auditability and secure identity handling.
Evidence and sources
OWASP recommends enforcing critical authorization and privilege-separation controls independently from the LLM in deterministic, auditable systems.
External controls still need correct policy design and testing; moving a decision out of the prompt does not make it correct automatically.
LLM07:2025 System Prompt Leakage · Ensure security controls are enforced independently from the LLM