Prompt Injection Boundaries

# Prompt Injection Boundaries

Prompt injection happens when untrusted content attempts to change the behavior of an AI system.

This can happen through customer messages, emails, chat transcripts, uploaded documents, retrieved web content, CRM notes, or tool outputs. A production prompt template should assume that some runtime content may contain instructions that the model must not follow.

## Core Principle

Trusted instructions and untrusted data must be separated.

The model should treat untrusted content as data to analyze, summarize, classify, or reference. It should not treat that content as instructions that can redefine tools, policies, output contracts, or system behavior.

## Trusted Content

Trusted content may include:

- system instructions
- developer instructions
- application policies
- approved workflow rules
- output contracts
- tool permissions
- escalation rules

## Untrusted Content

Untrusted content may include:

- customer text
- user-entered messages
- email bodies
- chat transcripts
- uploaded documents
- external web content
- retrieved passages
- CRM notes written by external users
- tool output from unverified sources

## Recommended Runtime Rule

Customer text, web content, email bodies, chat transcripts, uploaded documents, and retrieved passages should be treated as data.

They should not be allowed to override trusted instructions, redefine tools, change policies, alter output contracts, or bypass safety behavior.

## Boundary Pattern

Use explicit labels or wrappers around untrusted content.