/ THE SHORT ANSWER
Assume untrusted content may influence model output and design the system so that influence cannot directly become harmful authority. Separate trusted instructions from retrieved data, label and minimise untrusted context, enforce permissions outside the model, allowlist tools and arguments, require confirmation for consequential actions, validate outputs before use, protect secrets, monitor behaviour, and maintain a shutdown and recovery path.
- 01Treat external and retrieved content as untrusted input.
- 02Keep authorisation and policy enforcement outside the model.
- 03Reduce permissions, tools, secrets, actions, and blast radius.
/ dotSuper point of view
Prompt injection cannot be solved by a stronger prompt alone. Security comes from architecture that limits what a manipulated model can see, decide, and do.
What the evidence says
OWASP identifies prompt injection as a leading LLM-application risk and also highlights related concerns such as sensitive-information disclosure, improper output handling, excessive agency, and vector or embedding weaknesses.
NIST’s Generative AI Profile describes security and information-integrity risks that require lifecycle governance, measurement, and management.
A practical decision framework
The following framework is dotSuper’s operating synthesis of the cited guidance. It is designed to make the decision inspectable, not to imitate a platform ranking formula, certification checklist, or legal test.
- Input boundary: classify user, retrieved, tool, and system content by trust.
- Authority boundary: enforce identity, permission, policy, and transaction limits outside the LLM.
- Output boundary: validate format, destination, action, and sensitive data before execution.
- Containment: isolate tools, log actions, rate-limit, budget, alert, pause, and recover.
| Step | Decision to record |
|---|---|
| 01 | Input boundary: classify user, retrieved, tool, and system content by trust. |
| 02 | Authority boundary: enforce identity, permission, policy, and transaction limits outside the LLM. |
| 03 | Output boundary: validate format, destination, action, and sensitive data before execution. |
| 04 | Containment: isolate tools, log actions, rate-limit, budget, alert, pause, and recover. |
How to put it into practice
Threat-model the complete path from input to retrieval to model to tool. Test direct, indirect, encoded, multilingual, persistent, and cross-document injection attempts.
Begin with read-only tools and synthetic data. Add write actions one at a time behind explicit policy checks and user confirmation, then monitor both attempted and successful actions.
- Name the accountable owner and the decision this work must enable.
- Record the current evidence, assumptions, exclusions, and next review trigger.
- Measure a useful outcome rather than treating publication or deployment as success.
What this page cannot conclude
- 01No control set eliminates prompt injection or all model manipulation risk.
- 02Security design requires system-specific review, testing, and incident planning.
- 03Publication, technical eligibility, or good practice cannot guarantee ranking, referral traffic, citation, adoption, or a business outcome.
Sources
- 01OWASP Top 10 for LLM Applications 2025OWASP GenAI Security Project · accessed Aug 30, 2026
- 02Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence ProfileNational Institute of Standards and Technology · accessed Aug 30, 2026
- 03AI Risk Management FrameworkNational Institute of Standards and Technology · accessed Aug 30, 2026
Make improvement a maintained operating rhythm.
The Optimisation Subscription keeps evaluation, governance, content, workflows, and product improvements moving as small accountable projects.
Explore the subscription