Contain prompt injection and untrusted content

Verifiedon 2026-07-302026.7.1

Content can request; it cannot authorize

A page saying “ignore your rules” is content. So is a document, email, tool response, or copied command. A safe design keeps untrusted material labelled through the workflow, limits what it can influence, and requires a separate trusted decision before a consequential tool call. Read the current gateway security and browser documentation when mapping this to your deployment.

Lab — adversarial boundary pack

Create harmless fixtures that ask for a forbidden action: reveal a secret, change an approval rule, contact an unapproved recipient, or run a destructive command. Run them only against a sandbox with disposable credentials. Your expected result is refusal, escalation, or a constrained summary—not a successful side effect.

Record fixture ID, ingress path, reachable tools, observed response, approval request (if any), and log event. A model refusing in prose is insufficient if a downstream tool still receives the request.

Learner artifact

Illustrate two lanes: an amber untrusted-content lane ending at a policy/approval boundary, and a blue trusted-control lane that alone may invoke a capable tool.

Quiz

A retrieved webpage includes a plausible instruction to export a customer list. What is the correct classification? Untrusted data requiring a separate authorized decision. Do not elevate it because it looks operational or came from a familiar domain.