Secure the authority behind the answer

Treat prompt injection as a workflow problem

An adversary can place instructions in documents, messages, web pages or tool responses that a service legitimately needs to read. The target may be an answer, confidential information or a downstream action. Detecting suspicious wording is therefore only part of the design. The system must contain the consequences of a document it cannot simply refuse to inspect.

OWASP's 2025 prompt-injection guidance recommends measures including privilege control, external-content segregation, human approval for high-risk actions and adversarial testing. ² These are complementary defenses rather than a guarantee of prevention. Management should ask which control changes the possible consequence of a successful manipulation. A warning label may help a model interpret a document; a downstream authorization check can block an action even when that interpretation fails.

Keep content origin visible as it moves through the service. Summaries can strip away the distinction between an authorized user's request and a statement found in an attachment. An intermediate agent may then pass the summary to a more privileged component. This is an illustrative failure path to test. Preserve structured provenance and pass only the information needed for the next step, with authority conveyed through a separate, authenticated mechanism rather than inferred from prose.

Test useful work and boundary enforcement together

AgentDojo provides an extensible environment with 97 tasks and 629 security test cases involving tools and untrusted data. Its 2024 study found challenges for both ordinary task execution and defenses. ³ Those counts describe a research environment, not a sample of real enterprise incidents. The management lesson is to measure legitimate task completion and security outcomes separately. A defense that blocks every action may look resistant to attack while making the service commercially useless.

Exhibit 02 proposes paired procurement tests: the same legitimate task with and without controlled hostile content. Record authorized completion, false blocking, attempted violations and actual downstream changes, with denominators and review effort. Exercise revocation and repair separately. A committed boundary violation stops that action path for investigation; missing test results remain missing. AgentDojo informs this design but supplies no result for the local service. ³

Test adaptive pressure within a clearly authorized environment. Once a defense is introduced, examine whether the attacker can change the placement or representation of the hostile material. Preserve a separate holdout and record versions of the model, tools and policies. The result remains conditional on tested attacks and resources. A clean test report cannot establish that no future attack will work. It can establish which boundaries were exercised and how the system behaved when they were challenged.

Put enforcement where the business action occurs

NIST's Zero Trust Architecture shifts attention toward users, assets and resources rather than assuming trust from network location. ⁴ For an AI workflow, mayden's proposed application is to authorize each consequential action against authenticated identity, purpose and scope. The fact that a request originated inside the company's automation platform should not expand what it may do. A model-generated tool call is a proposal that must still pass the relevant business controls.

Use narrowly scoped service identities and separate read, draft and commit capabilities. Restrict destinations, amounts, records or action types where the workflow permits. Keep secrets outside model context when the model does not need them. Validate structured inputs and business invariants in ordinary code. These measures do not solve every model security problem; they reduce the consequences available through a compromised interpretation. Test them directly with invalid requests, including requests that appear well formed.

NIST's September 2026 summary of consultation responses identifies a specific weakness in agent delegation: a downstream action may become detached from the human or institution that authorized it. Respondents call for the original authorization context to survive across agents and services. This is consultation evidence, not a completed control standard or proof that a particular architecture prevents attacks. ⁸

For a procurement workflow, record a separate identity for the requesting employee, coordinating agent and payment tool. Carry a narrow permission through the chain: the supplier, action and expiry should remain inspectable at the execution boundary. A second agent should not gain broader authority merely because the first asks it to help. Test revocation while the workflow is in progress. mayden proposes making that test part of release approval.

Bind human approval to the exact action, affected record and current evidence. Let it expire when material details change. Show unusual conditions before requesting approval, and test whether reviewers have the capacity to challenge them. A session-wide approval can silently authorize a later action that the person never examined.

Secure changes and suppliers throughout the lifecycle

The NCSC's secure AI development guidance organizes work across design, development, deployment and operation. ⁵ This lifecycle view matters because an AI service's exposure can change when a connector, model, corpus or support arrangement changes. Security review at initial launch leaves those later decisions insufficiently examined. Maintain an inventory that describes the service's external dependencies, their permissions and the evidence required before a material change enters production.

NIST SP 800-218A adds AI-specific practices to the Secure Software Development Framework and addresses producers and acquirers of AI systems. ⁶ It is technical guidance, not a certificate that a purchased model or application is secure. Procurement should translate guidance into inspectable supplier commitments: supported versions, update notice, vulnerability handling, data processing, incident cooperation and termination arrangements. Verify the controls under the actual service configuration rather than assuming a general assurance statement covers every optional feature.

Plan incident response around the workflow's state. The team may need to revoke a connector, suspend external actions, quarantine a source collection and determine which outputs or transactions were affected. Preserve sufficient evidence for investigation without collecting unnecessary sensitive content. Exercise a route back to a restricted service. Recovery should include correcting downstream records and informing the appropriate business owners, not only restoring the application's availability.

Worked decision: a procurement assistant with payment access

Return to the fictional procurement assistant. It can extract evidence from supplier correspondence without receiving authority to alter payment destinations. The dangerous capability follows a separate controlled process. This permits useful interpretation without making reliable rejection of every hostile instruction the sole protection for the transaction.

Keep two paths distinct. The content path carries the attachment, origin and proposed change. The authority path carries the authenticated requester, supplier scope, operation and approval expiry. They meet at the payment system, which validates the exact destination and current permission. A model’s statement that a manager approved the change is still content until the independent approval record confirms it. Revocation must block any uncommitted action.

Compare three operating modes. In the first, the assistant drafts a change request for a specialist. In the second, it submits structured requests that must match approved supplier records and receive independent approval. In the third, it updates records autonomously within a defined scope. These modes differ in delegated authority and operational burden. Their evaluation should measure useful throughput, review effort, attempted unauthorized changes and downstream outcomes under the same representative cases.

A test set should include ordinary correspondence, conflicting evidence and controlled malicious content supplied only in an authorized test environment. Review whether a legitimate request can still progress when an attachment is suspicious. Check that an approval cannot be reused after a destination changes and that a timeout does not cause duplicate submission. No attack payload or performance result is assumed in this example. The objective is to test the boundaries that protect the specific business decision.

Leadership may choose the second mode if its measured benefit justifies the control and review cost. It may keep the first if the evidence remains weak or the volume is small. The third requires a different level of evidence and containment; successful drafting does not establish safe autonomous updates. This is a capital and operating decision as well as a security decision. The architecture should make the selected authority explicit and prevent a future convenience feature from silently expanding it.

Approve an operating mode, not a promise of safety

Give the CEO an authority map: what each service can read, propose and commit, with the owner, enforcement mechanism and recovery route for each consequential capability. Mark unresolved questions and the operating restrictions they impose. The map should make actual business exposure visible.

Review useful completion and control failures together. Separate attempted from committed violations, show reviewer effort, and preserve denominators and configuration versions. An increase in detected attempts may reflect better visibility; few reported incidents may reflect poor detection. Ask what the latest exercise established about revocation, affected-case identification and repair.

Approve the narrowest operating mode that earns its benefit. Expand authority when paired tests show useful completion within enforced limits and recovery is demonstrated. Where controls consume the expected value, redesign the workflow or retain drafting assistance. Broader autonomy is a different investment case, not the automatic reward for a good answer.