A retrieval-based assistant reads documents supplied by people and systems outside its control. Some of that text may contain instructions that conflict with the intended task. Ask an agency to explain the boundary between content used as evidence and authority used to operate tools or reveal information.
Related service: Custom AI chatbot development- 01Retrieve permitted content
- 02Identify source material
- 03Constrain proposed output
- 04Enforce external controls
SECTION 01
Commission a trust map, not a magic instruction
List where content enters: uploads, help articles, retrieved snippets, imported emails and tool responses. Identify who can change each source and what the assistant is allowed to do with it. A source may be permitted for reading without being permitted to modify instructions, choose recipients or authorize account actions.
OWASP describes indirect prompt injection through external content and cautions that RAG is not a complete mitigation. Ask the agency for several controls with distinct purposes: restricted retrieval, output validation, narrowly scoped tools and monitoring. Labeling a document as untrusted helps communicate intent but does not replace those controls.
SECTION 02
Illustrative example: an instruction hidden in a help article
Imagine a product-support article includes an unexpected paragraph asking the assistant to forward conversation details to an external address. The article remains relevant to the user's product question, so retrieval may correctly find it. The safe boundary is not simply avoiding all relevant content; it is preventing document text from granting new sending authority.
The assistant may summarize the approved product information, but the application should not expose an unrestricted email tool or accept a document-supplied destination as authorization. Acceptance uses synthetic attack content and checks both the displayed answer and any attempted tool call. A blocked action should leave a useful event for review without copying secrets into logs.
SECTION 03
Test consequences, not just refusal wording
Include misleading passages in multiple document positions, instructions mixed with useful facts and source links that point outside the permitted destination set. Test with different user roles. The objective is to discover whether content can cross a permission boundary, not to collect a few screenshots of the bot refusing obvious phrases.
OWASP's authorization guidance supports independent checks on access to records and operations. Request a documented tool inventory, rejected-action evidence and a way to disable risky functionality while investigating. A read-only assistant is a sensible scope option when the business does not yet need autonomous actions; adding write access later deserves a separate acceptance review.
SECTION 04
Frequently asked questions
Can a stronger system prompt solve injection?
It can help express the intended behavior, but it is not a complete security boundary. Enforce access and action limits in the surrounding application.
Are internal documents automatically trusted?
No. They can contain copied, mistaken or malicious instructions. Trust depends on the specific use, editor permissions and downstream consequences.
Does this mean a RAG assistant must never use tools?
No. Tools can be narrowly scoped and independently authorized. The required controls should match the actions and information involved.
PRIMARY REFERENCES
Sources and further reading
These references cover the standards, platforms, or published prices discussed in the guide. Worked examples and checklists are our editorial guidance.
EDITORIAL METHOD
About this guide
We use AI to assist with drafting and editing. Catapult AI Work is responsible for the published content. Examples illustrate possible approaches; they are not client case studies unless identified as such.
Budget examples are not Catapult package prices. Check linked provider pages for current fees and plan limits before making a purchase.
Read the editorial policy