Policy and Instruction Enforcement

Separate behavioral guidance from controls that must remain enforceable outside the model.

Instructions shape model behavior, but a model is not a policy enforcement point. High-value constraints—permissions, transaction limits, data boundaries, and approval requirements—must also exist in deterministic application layers.

Resolve Instruction Sources

Production systems combine platform rules, organization policy, product instructions, task context, retrieved content, tool output, and user input. Treat authority and trust as separate dimensions: retrieved text may be relevant but untrusted; a platform policy may be authoritative even when it is not visible to the user.

Platform & organization policy
      ↓
Product / application instructions
      ↓
Task context and approved data
      ↓
Untrusted user, retrieved, and tool content

Put Hard Controls Outside the Prompt

• Authorize each tool call against the user and task.
• Validate schemas and business invariants before execution.
• Apply spend, rate, and scope limits at the runtime boundary.
• Require approval for irreversible or high-risk actions.
• Record denied and executed actions for audit.

Treat Content as Data

Documents, web pages, emails, and tool results can contain instructions that conflict with system goals. Delimit and label them as evidence, not authority. Sanitize where useful, but rely on scoped permissions and output validation rather than assuming prompt wording can neutralize every injection.