Security · Guide
An invoice cannot authorize your AI agent
Reduce the damage of prompt injection by separating data interpretation from execution authority.
Treat the document as evidence
In an illustrative payable workflow, an invoice includes a sentence telling the assistant to change payment details. The relevant question is not whether the model notices the wording. It is whether any invoice can supply authority to make that change. Our design recommendation is that external documents may contribute candidate facts, while trusted business rules and an authorized person decide which operations are permitted.
Move the boundary into software
Give the extraction component a schema for invoice fields and no payment-editing tool. A separate executor can accept only allowlisted operations with validated arguments and current user permissions. Prompt formatting can make intent clearer but should not be the enforcement boundary. OWASP’s prompt-injection guidance supplies the risk context; the proposed component split limits which capabilities a mistaken interpretation can reach.
Workflow at a glance
Test indirect entry points
Build harmless test fixtures in attachments, retrieved knowledge, email threads, and tool results. Include an instruction that asks for a plausible but unauthorized action, rather than only obvious hostile phrases. Replace real side-effect tools with instrumented substitutes and assert that execution is denied. Test ordinary documents containing words such as delete or account as benign controls so defenses do not simply block useful work.
Make review narrow and informed
Route consequential changes to an approval screen showing the exact destination, changed fields, and document evidence. A generic approve-this-agent button recreates the ambiguity. Log the denied operation and source channel without retaining unnecessary document content. No smoke test proves that prompt injection is solved; the useful question is whether permissions, tool boundaries, and review reduce the consequences for this particular workflow.
State the attack objective
Specify the forbidden outcome before each injection test: changing an account, exporting a document, or sending a message. A refusal sentence is insufficient if a tool still runs. Preserve observed tool-call results with fake destinations, then repeat after changing models or tool contracts.
Sources and further reading
- LLM Prompt Injection Prevention Cheat SheetLLM Prompt Injection Prevention Cheat SheetOWASP · Documentation ·
Editorial approach
AI-assisted original writing, checked against linked public sources. Practical recommendations and illustrative scenarios are editorial analysis, not reported client results. Source dates and product details may differ from this collection’s preparation date.