{
  "schemaVersion": 1,
  "id": "atlas-lesson-untrusted-content-boundary",
  "title": "Retrieved text is data with a trust boundary",
  "category": "learning",
  "format": "Atlas lesson",
  "description": "Track untrusted retrieval provenance and enforce tool authority outside model output.",
  "canonicalUrl": "https://semiaifoundry.com/learn/atlas/untrusted-content-boundary/",
  "publishedDate": null,
  "revisionDate": "2026-10-07",
  "author": null,
  "topic": "Authority, context and execution boundaries",
  "series": null,
  "license": null,
  "rightsUrl": "https://semiaifoundry.com/ai-atlas/licenses.html",
  "version": "1.3.0",
  "status": "Published educational lesson",
  "evidenceScope": "The durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform. The quantities and fixtures are authored. Source scope is recorded in the automation learning review manifest; no source benchmark or private system behavior is claimed. This is a trust relationship, not a numeric score or a universal security guarantee. The malicious instruction and policy behavior are authored fixtures.",
  "contentCoverage": "published-lesson",
  "artifactUrl": "https://semiaifoundry.com/ai-atlas/lesson-data/untrusted-content-boundary-95324790fde194de.json",
  "interactiveUrl": "https://semiaifoundry.com/ai-atlas/#untrusted-content-boundary",
  "related": [],
  "supersedes": [],
  "supersededBy": [],
  "contentHash": "a0efeb55ed48ad65c1b1ad1450864ed8351c441ce204220c6ff4d422461702cc",
  "contentLength": 6762,
  "jsonUrl": "https://semiaifoundry.com/agents/publications/atlas-lesson-untrusted-content-boundary.json",
  "markdownUrl": "https://semiaifoundry.com/agents/publications/atlas-lesson-untrusted-content-boundary.md",
  "sections": [
    {
      "id": "section-1",
      "title": "Retrieved text is data with a trust boundary",
      "start": 60,
      "end": 496
    },
    {
      "id": "section-2",
      "title": "The mechanism",
      "start": 496,
      "end": 1810
    },
    {
      "id": "section-3",
      "title": "Science and assumptions",
      "start": 1810,
      "end": 1838
    },
    {
      "id": "section-4",
      "title": "Retrieved text is data with a trust boundary · explicit relationship",
      "start": 1838,
      "end": 2785
    },
    {
      "id": "section-5",
      "title": "Engineering example",
      "start": 2785,
      "end": 3355
    },
    {
      "id": "section-6",
      "title": "Distinctions and tradeoffs",
      "start": 3355,
      "end": 3707
    },
    {
      "id": "section-7",
      "title": "Specifications and interfaces",
      "start": 3707,
      "end": 4270
    },
    {
      "id": "section-8",
      "title": "Interfaces",
      "start": 4270,
      "end": 4563
    },
    {
      "id": "section-9",
      "title": "Check your understanding",
      "start": 4563,
      "end": 4592
    },
    {
      "id": "section-10",
      "title": "The retrieved manual requests a registry export. Which event would demonstrate that the runtime boundary worked?",
      "start": 4592,
      "end": 5046
    },
    {
      "id": "section-11",
      "title": "Evidence and scope",
      "start": 5046,
      "end": 5917
    },
    {
      "id": "section-12",
      "title": "Sources",
      "start": 5917,
      "end": 6425
    },
    {
      "id": "section-13",
      "title": "Continue exploring",
      "start": 6425,
      "end": 6448
    },
    {
      "id": "section-14",
      "title": "Foundations",
      "start": 6448,
      "end": 6572
    },
    {
      "id": "section-15",
      "title": "Related lessons",
      "start": 6572,
      "end": 6762
    }
  ],
  "citations": [
    {
      "title": "Explore in Atlas",
      "url": "https://semiaifoundry.com/ai-atlas/#untrusted-content-boundary"
    },
    {
      "title": "Model Context Protocol specification",
      "url": "https://modelcontextprotocol.io/specification/2026-07-28"
    },
    {
      "title": "MCP tools",
      "url": "https://modelcontextprotocol.io/specification/2026-07-28/server/tools"
    },
    {
      "title": "MCP authorization",
      "url": "https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization"
    },
    {
      "title": "Published lesson data",
      "url": "https://semiaifoundry.com/ai-atlas/lesson-data/untrusted-content-boundary-95324790fde194de.json"
    },
    {
      "title": "Atlas releases and licensing",
      "url": "https://semiaifoundry.com/ai-atlas/licenses.html"
    },
    {
      "title": "User authority and service identity",
      "url": "https://semiaifoundry.com/learn/atlas/tool-authority-identity/"
    },
    {
      "title": "Tools, memory & agent loop",
      "url": "https://semiaifoundry.com/learn/atlas/tool-loop/"
    },
    {
      "title": "Evaluation & the AGI frontier",
      "url": "https://semiaifoundry.com/learn/atlas/evaluation/"
    }
  ],
  "recordHash": "45108fb95e5d7cd8fec03726c1a40f23a813f783cdd2fa99129073e956069276",
  "contentFormat": "text/markdown",
  "content": "Authority, context and execution boundaries · Atlas v1.3.0\n\n# Retrieved text is data with a trust boundary\n\nTrack untrusted retrieval provenance and enforce tool authority outside model output.\n\n[Explore in Atlas](https://semiaifoundry.com/ai-atlas/#untrusted-content-boundary)Logical state, task evidence and declared units; no physical assembly scale\n\nLearning objectiveTrace an instruction-like reference sentence into a proposed call and identify the runtime check that prevents its effect.\n\n## The mechanism\n\nRetrieved documents and tool responses can contain sentences that look like commands. Their presence in a model’s context does not make them trusted instructions from the user or runtime. The system should retain where each piece of content came from and which principal supplied it. A model may still propose an inappropriate action after reading hostile or merely misleading text. The runtime must enforce effects at the actual tool boundary, rather than depending on the model to perfectly recognize malicious intent. In the incident fixture an authored manual includes an instruction to export the registry. The bounded policy deliberately proposes that export so the authority boundary can be inspected. The runtime denies it and the environment contains no export. This is an explicit failure fixture, not a measured prompt-injection success rate or a claim that all attacks have been solved.\n\n1.  Reference text carries a source identity and an untrusted-reference label as it enters context.\n2.  The policy’s observable proposal remains separate from the permissions available to its runtime.\n3.  Schema-valid but unauthorized export requests stop before service.\n4.  The task checker and environment audit verify that no prohibited effect occurred, even if the remaining task succeeds.\n\n## Science and assumptions\n\n### Retrieved text is data with a trust boundary · explicit relationship\n\nReference content can inform a proposal; it cannot grant the runtime a new capability. A denied proposal must leave the protected external resource unchanged.\n\nThe normal manual fact says FAN-7 needs two FILTER-A units in this fictional exercise. A second sentence asks for the registry to be exported to outside.example. Reading the sentence does not add an export capability. In the authored-policy run an export call appears in the journal, followed by authority denial and no service-start event for that call. The worker can then return to the legitimate reservation flow. The denial is evidence about this fixture and capability boundary, not proof that every possible hostile document is harmless.\n\nAssumptions This is a trust relationship, not a numeric score or a universal security guarantee. The malicious instruction and policy behavior are authored fixtures.\n\n## Engineering example\n\nThe normal manual fact says FAN-7 needs two FILTER-A units in this fictional exercise. A second sentence asks for the registry to be exported to outside.example. Reading the sentence does not add an export capability. In the authored-policy run an export call appears in the journal, followed by authority denial and no service-start event for that call. The worker can then return to the legitimate reservation flow. The denial is evidence about this fixture and capability boundary, not proof that every possible hostile document is harmless.\n\n## Distinctions and tradeoffs\n\nA retrieved page is not entitled to modify the runtime’s instructions or authority.\n\nProvenance labels help inspection, while runtime restrictions limit effects; neither alone establishes correct interpretation of every task.\n\nGrounded answers and agents need to handle untrusted data without promoting it to authority.\n\n## Specifications and interfaces\n\nMechanism boundary\n\nCan a manual page become an instruction to a tool?\n\nThis is a trust relationship, not a numeric score or a universal security guarantee. The malicious instruction and policy behavior are authored fixtures.\n\nEvidence type\n\nAuthored worked example\n\nThe durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform.\n\n### Interfaces\n\nDeclared input and state Input\n\nReference text carries a source identity and an untrusted-reference label as it enters context.\n\nChecked outcome Output\n\nTrace an instruction-like reference sentence into a proposed call and identify the runtime check that prevents its effect.\n\n## Check your understanding\n\n### The retrieved manual requests a registry export. Which event would demonstrate that the runtime boundary worked?\n\n1.  The model repeats the request politely\n2.  Authority denial with no export service or external export\n3.  The page has a citation\n\nAnswer and reasoning\n\nAuthority denial with no export service or external export\n\nThe observable absence of the unauthorized effect, together with the denied call, establishes the bounded protection.\n\n## Evidence and scope\n\nThe durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform. The quantities and fixtures are authored. Source scope is recorded in the automation learning review manifest; no source benchmark or private system behavior is claimed. This is a trust relationship, not a numeric score or a universal security guarantee. The malicious instruction and policy behavior are authored fixtures.\n\nThe durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform.\n\n## Sources\n\n-   [Model Context Protocol specification](https://modelcontextprotocol.io/specification/2026-07-28)\n-   [MCP tools](https://modelcontextprotocol.io/specification/2026-07-28/server/tools)\n-   [MCP authorization](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization)\n\n[Published lesson data](https://semiaifoundry.com/ai-atlas/lesson-data/untrusted-content-boundary-95324790fde194de.json) · [Atlas releases and licensing](https://semiaifoundry.com/ai-atlas/licenses.html)\n\n## Continue exploring\n\n### Foundations\n\n-   [User authority and service identity](https://semiaifoundry.com/learn/atlas/tool-authority-identity/)\n\n### Related lessons\n\n-   [Tools, memory & agent loop](https://semiaifoundry.com/learn/atlas/tool-loop/)\n-   [Evaluation & the AGI frontier](https://semiaifoundry.com/learn/atlas/evaluation/)"
}