What it means
Instructions can arrive directly from a user or indirectly through documents, websites, messages, tool output, and connected data. The model may not reliably distinguish trusted instructions from hostile content.
Why it matters
AI systems need conventional security boundaries because model behavior alone should not authorize sensitive access or irreversible action.
Practical focus
- Separate trusted control instructions from untrusted content
- Apply least privilege to tools and data
- Require approval for high-impact actions
- Log prompts, tool calls, decisions, and outputs with appropriate privacy controls
Common mistakes
- Relying on a system prompt as the only boundary
- Giving the model broad persistent credentials
- Allowing retrieved content to issue unrestricted tool instructions
Certification relevance
This subject appears in or supports the following certification bodies of knowledge: