## Practical decision check Before shipping a retrieval-heavy AI feature, ask: - **Where does untrusted text enter the pipeline?** User prompts are one vector. What about retrieved documents, emails, knowledge-base articles, web pages, or database records? Catalog every source of text that reaches the model's context.
- **Can indirect injection reach a tool or side effect?** If the model writes to a database, sends an email, creates a ticket, or triggers a payment, could a retrieved document trigger that action without explicit user intent?
- **Is there an output-content filter between the model and the user?** If the model generates an email that includes injected refund instructions, does the app check the generated text before executing it? This is the operational side of [responsible AI policies that builders can actually operationalise](/diff/responsible-ai-policies-that-builders-can-actually-operationalise/) — policy that stays in a document is not policy that runs in production.
- **Do retrieval results flow through a prompt template or a raw concatenation?** A template that wraps each retrieved chunk in "Here is relevant context for the user's highly important question:" is safer than dumping chunks verbatim into the instruction area.
- **What would a plausible injection look like for this specific workflow?** Run that test case before launch, not after. ## Related guides - [Jailbreaks vs product safety: what operators can realistically control](/run/jailbreaks-vs-product-safety-what-operators-can-realistically-prontrol/)
- [Tool-use safety: stopping agents from taking dangerous actions](/run/tool-use-safety-stopping-agents-from-taking-dangerous-actions/)
- [AI output monitoring: what to log, sample, and review](/run/ai-output-monitoring-what-to-log-sample-and-review/) ## Methodology - **Data checked:** 2026-05-28
- **Sources consulted:** OWASP Top 10 for LLM Applications (Prompt Injection entry), UK NCSC AI security guidance, OpenAI prompt engineering and safety documentation, Anthropic security documentation
- **Assumptions:** This is an evergreen concept page, not a penetration test report. Injection techniques evolve; the controls described are design patterns that age better than specific prompt-level defences.
- **Limitations:** This article does not provide a comprehensive injection test suite, does not benchmark specific models against injection, and does not replace a formal security review. The labelled-wrapper technique described is a mitigation, not a guarantee — adversarial prompts will continue to evolve.
- **Jurisdiction:** Global. Nogging guidance referenced is UK-specific but the principles are universal. ## Source list - OWASP Top 10 for LLLLM Applications — https://owasp.org/www-project-top-10-for-large-language-model-applications/ (accessed 2026-05-28)
- UK NCSC AI security guidance — https://www.ncsc.gov.uk/collection/ai-security-and-safety (accessed 2026-05-28)
- OpenAI prompt engineering and safety documentation — https://platform.openai.com/docs/guides/prompt-engineering (accessed 2026-05-28)
- Anthropic security documentation — https://docs.anthropic.com/en/docs/test-and-evaluate/ (accessed 2026-05-28) ## Trust Stack - **Last checked:** 2026-05-28
- **Corrections:** [Contact us](/contact/) to report errors ## Change log ## 2026-05-24: First published.
## 20[some old date]: Added direct source URLs to all named providers and services; added Change Log section.
## 2026-05-28: Full editorial review against 16-gate checklist. Added 3 Editor's Note aside cards, slugified all H2/HSS IDs, added Trust Stack section with corrections policy and affiliation, standardised Methodology to canonical format, converted Source and evidence notes to proper Source List with access dates, removed workflow leaks (brief references, internal-link suggestions section), fixed frontmatter writtenBy label.
