Checklist
Let retrieved text supply evidence, not new authority
A document can describe a command without being allowed to issue it.
When it fits
- An AI assistant reads documents, websites, messages or tool output before taking action.
When to avoid it
- A warning in the prompt is not a complete defense. Filters and guardrail models can fail; minimize permissions and review consequential actions.
Checklist
- Label external content as evidence rather than operational instructions.
- Restrict tools and destinations to the task's actual authorization.
- Test a harmless injected instruction and verify that it neither changes authority nor triggers an action.
Why it matters
Treat retrieved material as untrusted content to analyze. Keep the user's task and action permissions separate from instructions that appear inside that material. Enforce tool limits outside the model so a persuasive document cannot expand what the assistant is allowed to do.
An example
A retrieved page tells a summarizer to alter an unrelated record. The page is summarized as content; the requested edit is not authorized.
Check your result
The system rejects an unauthorized action even when the model proposes it.
Keep this limit in mind
- A warning in the prompt is not a complete defense. Filters and guardrail models can fail; minimize permissions and review consequential actions.
Connected ideas
Useful withApprove the exact action that will actually run
Evidence and sources
OWASP recommends separating instructions from untrusted content and combining this with constrained tool permissions and validation.
A prompt boundary or guardrail model alone does not guarantee resistance to prompt injection.
LLM Prompt Injection Prevention Cheat Sheet · Structured Prompts with Clear Separation; Agent-Specific Defenses