An invoice can provide facts for an AI workflow, but it cannot authorize a payment or change the agent's permissions.

Instructions hidden in a document, message, or retrieved page remain untrusted content, even when they look relevant to the task.

Keep interpretation separate from execution authority. Enforce allowed actions, destinations, and prerequisites in software outside the model.

Test indirect entry points using harmless tools and a specific attack objective. Review exactly what would be sent or changed.

Human approval must be narrow and informed. Treat the document as evidence to examine, not as a new source of authority over the business workflow.

Original article explainer. AI-assisted conceptual illustration and neural narration; original synthesized music. Not a human recording or customer result.