Mastery: connect the pieces

1. Idea — Prompt injection is untrusted content trying to steer the system away from developer policy—directly in user text or indirectly via retrieved docs.…
2. Mechanism — Separate instructions from data, constrain tools with least privilege, validate outputs, require approvals for consequential actions, and test adversarial conte…
3. Controls — tool allowlists, argument schemas, human approval gates, content delimiters, retrieval trust levels, output filters
4. Tradeoff — Blocking suspicious phrases is simple but produces false positives and misses paraphrases. Giving an agent broad tools increases usefulness and blast radius tog…
5. Failures — Indirect injection via ticket; Tool exfiltration
6. Metrics — red-team pass rate, false positive rate on benign, privileged action rate, time-to-contain
7. Ship rule — Ship agent with no payment tool autonomy; approvals on external send; weekly injection suite must be clean.

Neighboring layers (retrieval, serving, policy, human review) still own what prompt injection cannot on the tool-using support agent. Do not ask this chapter’s dial to replace permissions or source truth.

Mastery is transfer: take prompt injection into a second scenario that is not the tool-using support agent and rebuild the checklist without copying sentences. If you can only recite this chapter’s examples for prompt injection, you have memorized a story, not a model.

Also pin one numeric memory from this prompt injection chapter: risk ≈ probability of successful injection × impact of available capability; reducing tool privilege cuts impact even when detection is imperfect That number is not decoration; it is a template for how claims about prompt injection on the tool-using support agent should look in design docs. Scoped specifically to prompt injection / tool-using support agent / mastery-connect.

People confuse prompt injection with neighboring buzzwords when debugging the tool-using support agent. Before changing prompts, ask whether the broken stage was evidence gathering, the prompt injection judgment itself, validation, or the product action. Fixing the wrong stage creates folklore (“we tried prompt injection and it failed”) that blocks the next team on the tool-using support agent. Scoped specifically to prompt injection / tool-using support agent / mastery-connect.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.