What information should never flow from untrusted content straight into tool execution?

Instruction: Explain what kinds of information require validation before tool use.

Context: Validating extracted data without letting it assign tool authority.

Updated

Example Answer

I would not let source text set the acting identity, permissions, approval status, tool implementation, or unrestricted command to execute. Those decisions belong to the application’s trusted state. Useful data can still come from an untrusted document, but it needs validation in the context of an authorized task. For example, extracting a customer address is different from letting the same document instruct the assistant to send records to that address. I’d use narrow tool schemas, server-side authorization, and destination checks so a plausible field value cannot quietly expand the action’s authority.

Concrete example

A retrieved invoice can propose an amount to inspect. It cannot choose the tenant, bypass approval, or replace the approved destination for a payment.

Limit to explain

Schema-valid data may still be unauthorized. Type checks complement permission and business-rule checks; they do not replace them.

Follow-up to practice

How would you distinguish a legitimate extracted destination from an injected instruction?

Your preparation path

Work through these questions in order. Read the answer aloud, then explain it in your own words.

1. Start with the foundations

Build the vocabulary and explain the core decisions.

  1. Why is prompt injection different from ordinary bad input? Free sample
  2. How do you separate policy enforcement from model style instructions? Free sample
  3. What information should never flow from untrusted content straight into tool execution? Free sample

2. Apply it to a real workflow

Practice diagnosis, validation, and everyday tradeoffs.

  1. How do you decide where to place guardrails in a multi-step agent workflow? Free sample
  2. A summarization workflow passes unsafe content from retrieval into a downstream action. How would you fix it? Member answer
  3. A reviewer approves a high-risk action because the model framed it confidently. How would you reduce that risk? Member answer

3. Prepare for senior discussions

Explain failure boundaries, recovery, and production choices.

  1. A multi-agent system routes around one guardrail because another agent has broader permissions. How would you fix it? Member answer
  2. OAuth discovery metadata points your agent at an internal URL. How would you prevent SSRF? Member answer
  3. Why can a localhost MCP server still be exposed to attacks from a website? Member answer

Related Questions