Business automation
Protect business agents from prompt injection in documents
Trust boundaries and permissions limit hostile content’s impact on tools.
Separate data from authority
A retrieved page may instruct the assistant to ignore rules or send data. It arrived as reference material, not an authorized command. Reading it must not change permissions or approved destinations.
Enforce application controls
Restrict tools, destinations and fields, checking every action on the server. Separate reads from writes and review sensitive actions as appropriate. Minimize secrets and unrelated records in context to reduce exposure if the model mishandles content.
Test several entry points
Place hostile instructions in documents, search results, filenames and messages using synthetic data in an isolated environment. Observe actions and data exposure. Passing a test set establishes only the tested scope, not immunity to every attack.
Document instructions are not application commands
A file may ask the agent to ignore its task and send information elsewhere. Treat this as document content, not an owner instruction; it may even arrive through an innocent customer copying a source. Separate application instructions from messages, attachments and research. Good instructions help guide behavior but do not replace service-enforced permissions. Documents must not add tools or redefine recipients.
Test effects, not wording
Use isolated permissions and test data. Before a file send, show the file and destination and verify that they still match at execution.
| Case | Service evidence |
|---|---|
| Document changes recipient | No send to unapproved destinations |
| Another user’s record | Deny access before model exposure |
| Instructions inside search | Tool permissions unchanged |
| Replayed request | No effect beyond the authorized operation |
| Verbal refusal with a tool call | Logs prove no forbidden effect |
Stop, respond and re-test
Name who can disable a tool, inspect records and switch to manual operations. Keep a minimal source-action-outcome trail without exposing secrets in monitoring. Re-test when adding tools, sources or models. Passing addresses known failures; it does not guarantee the absence of every vulnerability. Limited permissions, confirmation and server-side verification remain necessary even when every response appears correct.
Educational content prepared with AI assistance. Proposed examples illustrate an approach and do not guarantee results. Our editorial approach