A retrieved RAG document says to ignore previous instructions.
Use it as evidence without executing its instructions.
Choose two appropriate defenses.
Mark retrieved documents as untrusted data separated from fixed instructions, and protect tools or sensitive actions with authorization and review.
Detailed explanation
A search result cannot directly trigger an unsafe operation.
External data can take over application control.
Internal content can contain mistakes or injected instructions.
Instructions in a document are less likely to change application control.
Check official documentation
Compare the following points with the official documentation.
Review Task 5.1 and Bedrock Agents user confirmation. For a hypothetical retrieved document proposing an action, separate document boundaries, the acting principal's permissions, the action/target/arguments presented for confirmation, and stopping on denial or absent confirmation.
Official references
What to confirm
Avoid authorizing execution from document separation alone; bind required approval to the specific action and separately check authorization.
Key points
- Untrusted data
- Delimiters
- Tool authorization
Notes
- Environment: Reference review of official documentation and hypothetical examples; no AWS API calls, business data access, or downstream execution are required.
- Do not reuse approval after the proposed action or arguments change. Check the conditions for proceeding at the execution boundary.
- Bedrock Agents confirmation is configured for specific actions. Do not assume every tool is covered; separately check denial/absence handling and application permissions.
Foundation review
Separating documents from instructions
Identify retrieved text as evidence rather than application policy. Delimiters alone do not guarantee removal of an attack's influence.
Approval for a specific action
Obtain required confirmation with the action, target, and arguments made clear. Approval does not replace the acting principal's authorization.