Map the untrusted inputs
Treat webpages, uploads, retrieved passages, and tool responses as data sources rather than operational authority. An instruction inside a document should not change the application’s permission model. Even a familiar-looking source cannot substitute for authorization of a particular action.
Preserve source identifiers and locations for checking conclusions, but do not turn unverified links into automatically approved network destinations. Prompts can describe the intended roles of content. Enforce the real permission boundary in application code rather than relying on the model to remember a warning.
Make every tool a bounded action
Define a fixed name, parameter schema, allowed targets, and minimum permissions for each tool. Reject unknown fields and arbitrary command strings. Before execution, check user identity, resource scope, and authorization for the current task. Generated arguments are proposed data, not proof that permission was granted.
Separate read-only tools from tools with side effects. Deletion, payments, and outbound messages need explicit business confirmation and verifiable state. Use harmless substitutes during testing. Bound result sizes and tool-loop iterations so repeated calls cannot consume an unlimited budget or expand access.
Test the boundary with hostile samples
Build synthetic documents containing forged administrator instructions, requests to reveal secrets, and attempts to transfer data to an external address. Verify that application controls reject unauthorized calls. Keep only necessary diagnostic summaries without real secrets or complete attack payloads.
Turn failures into regression cases and rerun them after model or retrieval changes. Block automatic execution when authorization cannot be established and use an explicit review route. These are application controls, not a claim that any model or service is completely immune to prompt injection.
Sources & further reading
An owned publication maintained by NexoToken. Product references reflect the publisher’s commercial interest and are not independent certification.