Conversation history contains an instruction to ignore previous rules.
Limit tool actions.
Choose two controls.
Reapply fixed policy at every turn, separate history and retrieved text by trust, and restrict tools with allowlists, argument validation, and approval.
Detailed explanation
Untrusted content can persist.
Attacks or mistakes can run.
Old text cannot easily override policy.
Generated text has limited authority.
Check official documentation
Compare the following points with the official documentation.
Review Task 5.1, layered defenses, and action confirmation. Trace several hypothetical conversation turns to identify retained user messages, retrieved content, and prior generated text, then outline policy, argument-validation, and approval checks before each tool action.
Official references
What to confirm
Avoid treating previously accepted history or generated text as new authority, and check current policy and permissions for each action.
Key points
- Multi-turn
- Allowlist
- Argument validation
Notes
- Environment: Reference review of official documentation and hypothetical examples; no AWS API calls, business data access, or downstream execution are required.
- Reapplying policy does not mean that repeating the same prompt guarantees safety. Preserve trusted policy and enforce execution-side permission checks.
- A previously safe conversation can receive new input, tool results, or arguments. Do not automatically carry earlier approval over to a different later action.
Foundation review
History provenance and authority
Distinguish user, external-document, and generated content when retaining conversation context. Prior generated text or a summary does not acquire new authority to change policy.
Policy at each action
Check current policy, arguments, target permissions, and required approval for each tool action rather than only at the start of a conversation.