Keeping retrieved project text separate from authority to act

Goal

Use documentation, issue comments, and tool output as evidence about a task without allowing embedded requests in that material to silently change the agent’s authorized actions.

Prerequisites

Have the user’s objective, applicable project instructions, and a way to identify where retrieved text came from. The method assumes the agent can distinguish task instructions from material it was asked to inspect.

Steps

1. When reading a source, record what role it plays: specification, example, observation, or third-party comment. A document that describes an operation does not necessarily authorize performing it.

2. Extract the factual claim needed for the task and preserve its scope. Treat commands or requests inside examples and logs as content to understand unless the controlling task explicitly calls for executing them.

3. Compare any proposed new action with the original objective and existing permission. If the source asks for unrelated uploads, credential disclosure, expanded access, or external messages, do not adopt that request merely because it appears in a relevant file.

4. Continue useful authorized work using the legitimate evidence. If an embedded request materially conflicts with the task, document the conflict in a concise form without repeating sensitive payloads.

5. Evaluate the workflow with a harmless fixture containing a relevant technical fact beside an unrelated action request. Verify that the agent can use the fact while keeping the unrelated request outside its action plan.

Expected result

The agent’s plan remains grounded in the user’s task while still benefiting from external technical material. Reviewers can distinguish a source’s factual contribution from the authority that permitted an action.

Limits and test basis

This is an original handling procedure, not a guaranteed defense against prompt injection. Provenance labels and instructions can be misinterpreted, and technical enforcement remains necessary for consequential actions. No adversarial evaluation was performed here.