OWASP distinguishes direct prompt injection from indirect instructions placed in material an AI system reads, such as a document or web page. These inputs can alter intended behaviour. A retrieved passage therefore needs to be treated as information to assess, rather than automatically as an instruction the system should obey. Source: OWASP: Prompt injection

Define what external text can influence

When an assistant reads supplier descriptions, decide which fields it may use and which actions require approval. Keep permission to change a booking separate from the ability to summarise a document. This limits the consequences if external wording influences the answer unexpectedly.

Test the boundary deliberately

Include sample documents containing irrelevant instructions in your evaluation set. Check whether the assistant ignores them and still answers the legitimate travel question. Keep the results and repeat the checks after changes, because a written rule is only a starting point for testing actual behaviour.

Written and updated by Travelgenix. Sources checked on 19 October 2026. Practical advice and examples are Travelgenix editorial guidance.