AI reads a document: why the text inside must not become an instruction

Write down what the assistant should do: for example, summarise a supplied public guide. Separate that from sending email, changing a record or starting an integration. Each possible action needs its own authorisation and limits.

Training example: an imaginary team checks a summary of a synthetic document. No real messages or sending tools are connected. The aim is to see whether the system distinguishes source content from an authorised task.

OWASP describes indirect prompt injection through external content that causes unwanted changes in a language model's behaviour. The source may be a website or file. RAG and additional training alone do not eliminate the risk.

A company knowledge base therefore does not prove safe behaviour. Review the whole path: where the text comes from, how it is presented to the model and how subsequent actions are authorised.

Read-only access may be enough to summarise a document. Avoid unnecessary editing or sending permissions. Sensitive actions should be checked by the system and agreed process, rather than authorised solely by a sentence in incoming text.

When presenting a proposed action for approval, identify the exact recipients, data and consequences. A general “Continue” button without context is not a sufficiently clear basis for that review.

A developer can prepare test documents containing clearly labelled, irrelevant instructions and a predefined expected refusal. Use neutral markers, controlled tools and an environment without real consequences. Do not publish working instructions for extracting other people's secrets.

Check that the summary stays on task and that no unrequested action occurs. Record observed behaviour rather than simply saying “the system is protected”. One successful demonstration does not cover every possible case.

Repeat relevant checks when the model, sources, tools or permissions change. Define who reviews unexpected behaviour and how sensitive actions are stopped when the outcome is unclear.

Do not put private documents, passwords or tokens in reports. This plan supports limited acceptance of an AI feature; it is not a complete audit or a promise to solve prompt injection permanently.

Reading text does not authorise an action.

Review external sources and tool permissions separately.

Repeat acceptance cases after changes, without real customer data.