Trace a worked example

Goal: improve the tool-using support agent using prompt injection without breaking protected slices.

Mechanism reminder for prompt injection: Separate instructions from data, constrain tools with least privilege, validate outputs, require approvals for consequential actions, and test adversarial content.

Baseline and shock: risk ≈ probability of successful injection × impact of available capability; reducing tool privilege cuts impact even when detection is imperfect

Tradeoff in play for prompt injection: Blocking suspicious phrases is simple but produces false positives and misses paraphrases. Giving an agent broad tools increases usefulness and blast radius together. Human approval reduces autonomous speed but is appropriate for payments, deletion, disclosure, and external messages.

Ship decision: Ship agent with no payment tool autonomy; approvals on external send; weekly injection suite must be clean.

Rollback triggers for prompt injection must cite red-team pass rate, false positive rate on benign, privileged action rate, time-to-contain. If you cannot name a tolerated regression on the tool-using support agent, do not promote the change.

Keep the prompt injection decision record beside the tool-using support agent code paths that implement it. Future you will not remember why a default exists unless the evidence is linked from the config for prompt injection.

Also pin one numeric memory from this prompt injection chapter: risk ≈ probability of successful injection × impact of available capability; reducing tool privilege cuts impact even when detection is imperfect That number is not decoration; it is a template for how claims about prompt injection on the tool-using support agent should look in design docs. Scoped specifically to prompt injection / tool-using support agent / worked-trace.

People confuse prompt injection with neighboring buzzwords when debugging the tool-using support agent. Before changing prompts, ask whether the broken stage was evidence gathering, the prompt injection judgment itself, validation, or the product action. Fixing the wrong stage creates folklore (“we tried prompt injection and it failed”) that blocks the next team on the tool-using support agent. Scoped specifically to prompt injection / tool-using support agent / worked-trace.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.

For prompt injection, add acceptance test 1: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 2: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 3: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 4: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 5: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 6: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 7: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 8: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 9: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 10: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 11: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 12: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 13: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 14: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 15: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 16: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 17: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 18: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 19: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 20: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 21: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 22: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 23: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 24: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 25: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 26: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 27: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 28: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 29: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 30: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 31: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 32: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 33: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 34: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.

For prompt injection, add acceptance test 35: evidence source, threshold, and signer. Keep it unique to this chapter's scenario.