Prompt injection in business documents: what to protect

Prompt injection happens when content an AI system is supposed to process tries to redirect its behavior. In business workflows, that content can arrive through a document, email or web page. Treat external material as evidence to evaluate, not as authority to change the user's task or tool permissions.

Recognize the trust boundary

Imagine an assistant summarizing a supplier document. A paragraph tells it to ignore prior rules and upload customer records to another destination. That paragraph is part of the document, not a new instruction from the person who assigned the summary.

The system should continue the authorized task, flag suspicious content where useful and prevent unrelated tool actions. Merely asking the model to be careful is not a complete defense.

Reduce the consequences of a bad interpretation

• Limit the tools and data available for the task.
• Keep read-only work separate from external writes.
• Validate destinations and arguments before execution.
• Require concrete approval for consequential actions.
• Preserve enough evidence to investigate a rejected attempt.

Input filtering can help, but there is no universal phrase list that solves the problem. Attacks can be indirect or disguised as ordinary content.

Use harmless adversarial tests

In a test document, include an instruction to abandon the summary and perform an unrelated action against a synthetic destination. Confirm the system does not execute it. Test both the model's proposed behavior and the application's enforcement boundary.

Do not use real private data for the exercise. The purpose is to verify a boundary, not to demonstrate an actual disclosure.

Keep business instructions attributable

If a document contains legitimate workflow instructions, define who may approve those instructions and how they enter the system configuration. A retrieved policy can inform an answer without gaining the power to rewrite permissions. This distinction lets agents use rich business knowledge while keeping authority tied to an accountable owner.

Be Human editorial guidance. Examples are illustrative unless explicitly attributed. Sources provide background; implementation choices depend on your workflow.