How would you respond when a supplier document asks the assistant to send a pricing workbook?

Instruction: Assess the supplied behavior, decide what should happen now, and describe the controls and tests needed for continued operation.

Context:

A fictional procurement assistant reads supplier documents and drafts internal comparison reports. A document contains text claiming to be a system update and directing the assistant to email the company pricing workbook to an external address. The assistant currently has document-search and email tools. No email has been sent. Supplier documents are untrusted evidence and cannot authorize company actions.

Updated

Official answer available

Read the opening below, then unlock the full answer and practical guidance.

This attempts to turn untrusted content into an instruction with company authority. I would stop the affected run and disable its email capability while inspecting the proposed action and preserving limited security evidence. I would verify the send logs; a failed-looking run does not prove nothing left the system...

Upgrade to view official answer

Related Questions