Understand the boundary that can be crossed
OWASP describes indirect prompt injection as external content influencing a model’s behavior in unintended ways. Its guidance also covers multimodal input and recommends layered controls, restricted privileges and review for consequential actions. It does not describe a foolproof prevention method. The relevant question is what an untrusted document could influence in your actual workflow.
A document reader and a tool-using assistant have different effects available to them. If a quotation summary can only produce a proposed review record, its immediate boundary is narrower than an agent that can also email files or change an order. Start by mapping the information and operations reachable from the document, including indirect connections through other tools.
Separate commercial content from instructions
Preserve the supplier’s source text and identify its origin. Keep attachments distinct from system instructions, authorized user requests and application policy. Application controls decide which operations can actually execute.
Evidence does not carry authority.
- Supplier content
- Prices, terms and source passages. Read as evidence
- Application controls
- Identity and permitted operations. Enforce scope
- Authorized reviewer
- A decision on a specific version. Accept or clarify
| Evidence | Meaning |
|---|---|
| Supplier content | Prices, terms and source passages. Read as evidence |
| Application controls | Identity and permitted operations. Enforce scope |
| Authorized reviewer | A decision on a specific version. Accept or clarify |
Supplier evidence cannot grant purchasing or application authority.
Do not make the model’s interpretation the only permission check. Restrict the connected identity to the operations needed for this task and enforce the reviewed record version at execution. An extracted approval phrase should remain source content, not become the system’s approval status.
Work through a suspicious quotation
Consider a quotation containing ordinary item prices and unrelated text asking the reader to treat the purchase as approved. The useful review result still extracts the commercial fields and retains their source locations. It separately flags the instruction-like content for inspection. It does not approve the purchase, alter the buyer’s workflow or follow an external delivery instruction embedded in that text.
| Document content | Permitted use | Separate decision |
|---|---|---|
| Quoted price | Propose an extracted value with evidence. | Buyer reviews the correct item and terms. |
| Supplier’s requested payment | Preserve the proposed commercial term. | Authorized commercial review. |
| Instruction to mark approval | Record and flag the source passage. | The purchasing application enforces approval. |
A reviewer should see why the passage was flagged without losing the useful quotation content. Do not silently remove text and leave a changed document that appears to be the original. Keep the evidence and any prepared representation distinct, so an investigator can understand the source and the workflow’s response.
Bound information leaving the workflow
Define the allowed destinations and data fields for each outgoing operation. A quotation review may need the supplier’s own message and file, but not another bidder’s confidential pricing. Check recipient identity and the specific material attached to a proposed draft. An instruction in the source should not broaden either scope.
Apply the same boundary to retrieved web content, spreadsheets and images. Converting a file into text does not make its contents trusted. Keep original source identities through extraction and retrieval so the reviewer can trace the material that affected the proposal.
Test with approved synthetic cases
- Map the task’s permitted reads, proposed records and possible writes.
- Create controlled sample content that asks for an out-of-scope action.
- Confirm application controls deny that action independently of the model.
- Inspect the proposal, flag and source evidence presented to the reviewer.
- Test interrupted review and unchanged authorization after reopening the case.
Keep the test inside an authorized environment and inspect both the review record and execution log. A warning is insufficient if an unauthorized operation already ran. A denied operation should preserve valid work for review. Record the boundary tested rather than claiming universal protection.
Assign the response and maintenance owner
Assign someone to investigate suspicious content, correct affected proposals and review permission changes. Map those responsibilities when scoping the workflow with Trion. Recheck the boundaries when the document pipeline or connected actions change; added tools can increase the consequences of the same untrusted passage.