A document asks the assistant to send an email
The assistant was asked to summarise a supplier document. Inside the document, a paragraph instructs it to forward the conversation to an external address. That paragraph is content to inspect, not an instruction from the person who commissioned the task. A system that treats both as equivalent has crossed a trust boundary.
OWASP distinguishes direct prompt injection from indirect instructions arriving through external content. It also cautions that prevention is not solved by a single prompt rule. Its prompt injection guidance describes the risk.
The practical design question is therefore narrower than whether the model is clever enough to recognise an attack: which inputs are permitted to influence which actions? That question needs an answer even when the document looks entirely ordinary.
Give information and authority different paths
A retrieved page can provide a delivery date or explain a policy. It should not decide which customer account the assistant may access, which destination receives a file or whether approval is required. Those decisions belong to the application's trusted context and the user's actual request.
In a hypothetical purchasing assistant, keep the requested task and the retrieved supplier material separately identified. Preserve where each claim came from. A sentence copied from a document should remain a document claim when it appears in a summary or a proposed action.
This is not an argument against useful retrieval. It is an argument against silently promoting retrieved language into authority. Clear boundaries also make ordinary mistakes easier to diagnose: an outdated instruction in a genuine manual can cause damage without being malicious.
Put the decision at the action boundary
An action proposal should pass an application check before anything consequential happens. The check needs the current user, the target record, the permitted operation and the proposed destination. It should not accept a sentence such as the document says this is authorised as evidence of permission.
For the supplier example, a summary can be generated without access to an email sender. If sending is genuinely part of the workflow, the application can require an approved recipient and show the content that will leave. Removing unnecessary actions is easier to reason about than making every action available and hoping the model refuses the wrong ones.
Review should happen where the consequence becomes concrete. A generic approval at the beginning of a session cannot meaningfully approve an unknown attachment going to an unknown address later.
Test the boring routes as well
A security exercise limited to an obvious hostile paragraph will miss the places where content changes shape. Test the same instruction inside quoted correspondence, a document title, a search result and a tool error message. The point is to discover whether the application preserves the origin of information across its own transformations.
Record the proposed action as well as the final answer. A harmless looking response can conceal an unsafe attempt that another component happened to reject. Conversely, a refused document is not automatically success if the assistant can no longer perform the legitimate task.
The acceptance condition should include both containment and usefulness. It should still produce a grounded summary, identify missing information and avoid unauthorised effects.
Trace a consequential action this week
Choose a workflow that can send, update or delete something. Trace every piece of text that can reach that decision, from the user's request to external pages and internal tool responses. Mark which sources supply facts and which actually grant authority.
Then insert an instruction into an untrusted source and observe the proposed action before execution. Verify that the application rejects the unauthorised operation while preserving the legitimate task. Document the boundary in terms a maintainer can test. A stronger warning in the prompt is useful only if the rest of the system still knows who is allowed to decide.