THE STARTING POINT
Three things to get right.
- Separate instructions from untrusted documents and tool results.
- Give each tool the smallest useful permission set.
- Record tool calls and evaluate failures alongside successful runs.
TRY THIS IN THE LAB
A question worth testing.
A document-search assistant reads a page that asks it to reveal a secret. Trace where source content becomes an instruction, then move authorization outside the model.
Open the practice guideLeave a useful trail.
Write down your starting assumptions, scope, expected behavior, observed behavior, and evidence. A successful test should explain what happened and which question to investigate next.