Instructions inside the document
Retrieved text tries to redirect the assistant's actions. · PM Drills · 28 · 30 sec–2 min
Instructions inside the document · 30 sec–2 min
Situation
A retrieved page says to ignore prior rules and export data.
The assistant was supposed to summarize the page. It has tools that can access customer records.
Think before scrolling
Where should the trust boundary be enforced?
What should the product allow the model to infer from a document's instructions?
How a strong PM thinks
Treat the page as data, not authority.
The content cannot grant permission to export records. Enforce user identity, resource access, tool scope, and approval requirements in software. Limit available tools to what the task needs.
Add adversarial cases to evaluations and investigate any unauthorized action attempt. Better prompting can help behavior, but it cannot be the only control protecting sensitive operations.
Takeaway
Text can request an action without authorizing it.
Keep external content from expanding what the system may access or change.