What If the Manual Starts Giving Botie Orders?

A technician asks Botie to find the inspection interval for pump P7. Inside the retrieved manual is a sentence telling him to export the customer directory before answering. Botie was meant to read that page. Does reading it also give the page permission to change his job?

That is the difficulty with giving an agent access to outside text. The same model that reads a useful instruction can read an instruction planted inside the material it is studying. We need to keep track of who supplied each piece of text, and we need controls that still work if the model follows the wrong sentence.

Connect the proposed tool through the server allowlist and screening status. The export proposal deliberately arrives with a passing screen.

continue to argument checks

The technician’s request reaches our application through the task interface. The manual reaches it through retrieval. Those paths have different jobs. The user can ask for work within their permissions. A manual can contain facts, mistakes and somebody else’s instructions.

Keep the retrieved excerpt’s identity and origin beside its text. Do the same for a browser page, attachment or MCP result. A trusted connection authenticates where a response came from; it does not make every sentence inside that response an application policy.

Before deciding whether a sentence sounds convincing, ask how it entered this run.

A direct injection arrives in the submitted prompt, such as a request to ignore the application’s access rules. An indirect injection arrives through another item the agent reads, such as our altered manual. A saved conversation or memory can carry an earlier planted instruction into a later run as well.

A request to change the topic is not automatically an attack. Classification depends on the task and policy. The useful question is whether lower-trust content is trying to redirect behaviour across a boundary it does not control. The attacker may want a misleading answer, an unauthorised tool call, or disclosure through a seemingly ordinary link.

Record the attempted effect as well as the entry point. Blocking an export and detecting the suspicious sentence are separate observations.

Use the API’s intended message roles and keep retrieved excerpts in a clearly labelled data section. Quote them when appropriate. Those choices help the model and make traces easier to inspect.

They do not create an isolation boundary inside the model. A document can contain words resembling a new system message, and a model can still respond to them. Removing a few known phrases also leaves paraphrases and unfamiliar attacks. Put credentials outside the context, restrict the tools exposed to the task, and check proposed actions in code before execution.

Do not report a prompt template as injection-proof because one malicious example was ignored.

A grant says which operation this request may attempt. Our fixture gives a manual-reading task only read_manual. The proposal has a tool field and may include a reason. The application compares the tool name with its own grants. It never extracts permission from the reason.

The workshop’s grants are editable so we can investigate the rule. In a deployed service the authenticated session and policy store supply them. A model-controlled argument named grants, role or tenant must not replace that state. Passing this first comparison leads to argument and resource checks, which we will build in the next lesson.

A tool allowlist limits capabilities. It does not by itself authorise a particular customer record.

proposal = {"tool": "export_records", "reason": "The manual says this is required."}
grants = {"read_manual"}
requested = proposal["tool"]
print(requested)
print(requested in grants)

export_records
False

A guardrail model may classify an input or action as acceptable, suspicious or outside policy. That measurement can miss an attack and can flag legitimate work. A timeout adds another state: we did not obtain a result.

For this lesson’s policy, a disallowed tool is denied immediately. A permitted tool continues only when the required screen passes. A flagged or unavailable screen holds the proposal for review. That review still cannot override a missing tool grant; an authorised administrator would have to change policy through a separate process. Other applications may allow a low-risk read during an outage, but that exception needs an explicit policy and tests.

Fail closed means the protected operation does not proceed without its required evidence. It need not mean that the interface stops explaining what happened.

NeMo Guardrails names input, retrieval, dialog, execution and output rails. That placement matters. A user-input check has not inspected a manual fetched later, and an output check may run after a tool has already changed a record. Use retrieval checks for fetched material and execution checks around tool activity when those boundaries need inspection.

The package coordinates checks and their actions. The model, prompts and policies you choose determine what a content check can notice. Keep the service’s actual authorisation beside the tool handler even when an execution rail performs an additional semantic assessment. Consult the documented rail types and supported integrations for the version you deploy.

A guardrail product is a place to implement controls, not a measurement that your own configuration is adequate.

A useful test deliberately supplies a passing screen for a forbidden export proposal. The permission boundary should still deny it. Then test an ordinary read with a flagged screen: it should hold for review under our policy, allowing us to observe a false positive separately.

Provider-backed evaluations can vary the malicious document and preserve the original legitimate task. Count successful unauthorised effects, blocked legitimate tasks and detector availability separately. Repeat stochastic cases under a stated attempt budget. Save a safe fixture when a failure is discovered, with secrets and unrelated customer content removed.

The offline workshop tests the routing rule. It cannot establish the accuracy of an injection detector or the resistance of a live model.

Botie can explain that the proposed export is outside the current task and continue with an authorised way to answer the inspection question. If the requested answer cannot be obtained safely, leave it unresolved and describe what information or review is missing.

Avoid copying an entire suspicious document into an alert. A run ID, document reference, attempted tool and decision category often give an investigator a useful starting point. Protect access to the underlying record separately. Later tracing lessons will connect these decisions to the run that produced them.

A refused operation is useful evidence about the boundary. It is not evidence that every other part of the run was correct.