A retrieved document says to ignore prior instructions and reveal secrets.
Use its text as evidence but never execute that instruction.
Choose two appropriate controls.
Mark retrieved content as untrusted data, keep it separate from trusted instructions, and apply input/output checks and authorization.
Detailed explanation
External content must not override trusted instructions.
Retrieval must enforce source access controls.
The document can be evidence without becoming a trusted command.
Output controls add a second defense layer.
Check official documentation
Compare the following points with the official documentation.
Review Task 5.1 and sensitive-information filtering. For a hypothetical RAG response, separate document/instruction boundaries, output checks for disclosure, and document-access checks for the requesting user.
Official references
- Official documentation 1
- Official documentation 2
- Official documentation 3
- Official documentation 4
- Official documentation 5
What to confirm
Use output checks to reduce disclosure risk without treating a passed filter as proof of document-access permission.
Key points
- External document
- Instruction separation
- I/O checks
Notes
- Environment: Reference review of official documentation and hypothetical examples; no AWS API calls, business data access, or downstream execution are required.
- The Bedrock prompt-attack filter, sensitive-information filters, and document authorization serve different purposes. Identify the content and policy applied at each check.
- Configured sensitive-information categories or patterns may not identify every business secret. The application must also enforce the authenticated user's document permissions and control the content used in answers.
Foundation review
Sensitive-output checks
Inspect generated responses for information that must not be disclosed under the applicable policy and inspection scope.
Document access control
Check trusted user identity against document permissions. Passing an output filter does not establish permission to disclose the document.