Prompt injection: design the permissions, not the filter
Written for teams putting an LLM in front of data they do not control.
AI Tools Hub Editorial · published · updated
What actually happens
- A document summary task follows instructions inside the document and exfiltrates another file
- An auto-reply follows instructions inside the incoming message
- A code review follows a comment and prints credentials
- A page summary inserts a link the page asked for
Why filtering fails
Blocking "ignore previous instructions" does nothing against the same intent phrased differently, written in another language, encoded, or embedded in an image. This is not a problem pattern enumeration converges on.
Design on the permission side
| Principle | Implementation |
|---|---|
| Reading grants no authority | Separate the read path from write and send paths |
| Minimum privilege | Read-only APIs; writes require human approval |
| Fixed destinations | Allowlist outbound targets; no dynamic URLs |
| Bounded blast radius | Distinct credentials per task, scoped narrowly |
| A confirmation step | A human screen before anything irreversible |
The goal shifts from preventing the attack to making a successful attack uninteresting. That is the achievable target.
Agents deserve extra care
In a multi-step agent, what one step reads influences the next step's decision. The dangerous shape is reading inbound mail or chat and then sending something outward, because the attacker fully controls the input. Do not ship that without both destination and content fixed.
FAQ
Is internal-only data safe?
Not if any of it was submitted from outside. Contact form content, inbound email and partner-supplied files are external data.