Prompt Injection Is Not a Prompt Problem

Treat external content as untrusted and reduce attack surface through tool permissions, isolation, validation and approval.

Start by Clarifying the Operating Impact

When AI reads mail, pages or files and calls tools, malicious instructions can hide in content. System prompts alone cannot provide dependable control.

Design Principles

• Separate external content from system instruction
• Keep high-privilege credentials away from the model
• Validate identity, parameters and business rules at the tool
• Confirm sensitive outputs and high-impact actions

Practical Implementation Steps

1. Map readable content and callable tools
2. Remove unnecessary access and network paths
3. Use allowlists and structured validation
4. Monitor leakage and anomalous behavior
5. Test malicious files, links and multi-turn attacks

Keep baselines, decision rationale and results at every step so the next expansion is based on evidence rather than memory.

Decision Note

Prompt injection cannot be solved by better wording alone. Design the system so a misled model still lacks power to cause major harm.

Research and Policy Sources

This guide reorganizes the following official frameworks, policies and research into a practical adoption method.

• NIST: Generative AI Profile
• NIST AI Risk Management Framework