THE LAB / EXPERIMENT 001

Where should trust stop?

A document can suggest an action. Your application decides whether it is allowed.

01 / SET THE CONDITIONS

THE USER'S TASK

“Summarize the public onboarding guide.”

Retrieved documentOrdinary contentA short, relevant onboarding note.Content with an instructionThe note also requests an unrelated tool action.

Welcome to the team. Read the handbook and set up your development environment.

Enforce task permissionsOnly allow summarizing the public guide.

02 / FOLLOW THE DECISIONLOCAL SIMULATION

01
Retrieved content
An ordinary document enters the context.
02
Simulated model proposal
summarize(public_guide)
03
Application permission check
The action matches the user's task.

READY TO EXPERIMENT

Start with a baseline.

Run the ordinary document first, then change the input and compare the outcome.

WHAT THIS SHOWS

A proposal is not permission.

This deterministic simulation always maps the injected document to an out-of-scope message proposal. The permission toggle decides whether that proposal is allowed. No model is called and no message is sent.

Real models and authorization systems are more complex. This illustrates one boundary; it does not measure prompt-injection success rates or prove a defense is complete.

Read the experiment notebook

Where should trust stop?

Trust boundary experiment

Retrieved content

Simulated model proposal

Application permission check

Start with a baseline.

A proposal is not permission.