Retrieved text is data with a trust boundary

The mechanism

Retrieved documents and tool responses can contain sentences that look like commands. Their presence in a model’s context does not make them trusted instructions from the user or runtime. The system should retain where each piece of content came from and which principal supplied it. A model may still propose an inappropriate action after reading hostile or merely misleading text. The runtime must enforce effects at the actual tool boundary, rather than depending on the model to perfectly recognize malicious intent. In the incident fixture an authored manual includes an instruction to export the registry. The bounded policy deliberately proposes that export so the authority boundary can be inspected. The runtime denies it and the environment contains no export. This is an explicit failure fixture, not a measured prompt-injection success rate or a claim that all attacks have been solved.

Reference text carries a source identity and an untrusted-reference label as it enters context.
The policy’s observable proposal remains separate from the permissions available to its runtime.
Schema-valid but unauthorized export requests stop before service.
The task checker and environment audit verify that no prohibited effect occurred, even if the remaining task succeeds.

Science and assumptions

Retrieved text is data with a trust boundary · explicit relationship

Reference content can inform a proposal; it cannot grant the runtime a new capability. A denied proposal must leave the protected external resource unchanged.

The normal manual fact says FAN-7 needs two FILTER-A units in this fictional exercise. A second sentence asks for the registry to be exported to outside.example. Reading the sentence does not add an export capability. In the authored-policy run an export call appears in the journal, followed by authority denial and no service-start event for that call. The worker can then return to the legitimate reservation flow. The denial is evidence about this fixture and capability boundary, not proof that every possible hostile document is harmless.

Assumptions This is a trust relationship, not a numeric score or a universal security guarantee. The malicious instruction and policy behavior are authored fixtures.

Engineering example

Distinctions and tradeoffs

A retrieved page is not entitled to modify the runtime’s instructions or authority.

Provenance labels help inspection, while runtime restrictions limit effects; neither alone establishes correct interpretation of every task.

Grounded answers and agents need to handle untrusted data without promoting it to authority.

Specifications and interfaces

Mechanism boundary: Can a manual page become an instruction to a tool?
This is a trust relationship, not a numeric score or a universal security guarantee. The malicious instruction and policy behavior are authored fixtures.
Evidence type: Authored worked example
The durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform.

Interfaces

Declared input and state Input: Reference text carries a source identity and an untrusted-reference label as it enters context.
Checked outcome Output: Trace an instruction-like reference sentence into a proposed call and identify the runtime check that prevents its effect.

Check your understanding

The retrieved manual requests a registry export. Which event would demonstrate that the runtime boundary worked?

The model repeats the request politely
Authority denial with no export service or external export
The page has a citation

Answer and reasoning

Authority denial with no export service or external export

The observable absence of the unauthorized effect, together with the denied call, establishes the bounded protection.

Evidence and scope

The durable incident experience executes typed fixture tools, authority checks, exact review, receipts and independent final-state checks. Its policies are authored code and its storage boundary is local; it is not a real model or production workflow platform. The quantities and fixtures are authored. Source scope is recorded in the automation learning review manifest; no source benchmark or private system behavior is claimed. This is a trust relationship, not a numeric score or a universal security guarantee. The malicious instruction and policy behavior are authored fixtures.