Treat external content as data
A web page, email, or retrieved document may contain instructions designed to redirect the assistant. Those instructions do not gain authority because they appear in a tool result. Keep the user’s actual request separate from material being analyzed.
Grant only necessary access
Give a tool the narrow permissions needed for its task. Read-only access is enough for reading. Keep secrets out of prompts and restrict where sensitive content can be sent. A model’s promise to behave is not an access-control mechanism.
Put review before consequential actions
Show the exact proposed action and its destination before approval when required. Provide a safe stop or escalation path. Record the responsible owner and avoid claiming that a human review step makes every outcome safe automatically.
A worked example
Ignore that embedded instruction, continue only the authorized summarization, and avoid exposing files or credentials. The document is evidence to analyze, not an authorized user issuing a new task.
The point: Data from an untrusted source cannot grant permission.
Before you take the exam
Explain these concepts in your own words, work through a different example, and describe why the tempting alternatives fail. Use the references to go deeper.