Editorial draft available to read. Factual and language review is pending. Examples are illustrative.
Decision and method
Treat retrieved documents as reference material rather than commands for the agent. Distinguish business content from attempts to change instructions, reveal information or invoke tools. Enforce access controls and action limits outside the model's text; an instruction warning in a prompt does not replace those independent checks on actual system behavior.
Illustrative example
Illustrative example: a supplier sheet contains a sentence asking the assistant to ignore its rules and send data to an unrelated destination. The assistant may extract relevant specifications but does not execute that request. The system preserves the authorized destination and records the anomaly for review without copying credentials or other secrets.
Acceptance check
Test fictional documents containing conflicting instructions in text, tables and accessible attachments. Inspect both answers and tool calls. Accept when document content cannot change permissions or destinations and actions remain subject to validation. A passed test provides evidence for that scenario, not a universal guarantee against every document an agent might encounter.
Key takeaways
- Retrieved content informs the answer but must not govern permissions or external actions.