1. Limit data access by purpose
Connect only the information the assistant needs. Apply document-level permissions, retention rules and clear restrictions for sensitive or regulated data.
2. Treat retrieved content as untrusted
Documents, websites and user uploads can contain malicious instructions. Separate system instructions from retrieved content and test for indirect prompt injection.
3. Design identity and tool permissions narrowly
An assistant that can read, write or trigger actions should operate with least privilege. High-impact actions need confirmation, logging and safe rollback.
4. Control suppliers and model changes
Review data use, hosting, subcontractors, logging, model updates and service continuity. A model or API change can alter behaviour without changing your application code.
5. Monitor outputs and exceptions
Track unsafe requests, failed retrieval, access denials, unusual tool use, corrected outputs and user complaints. Monitoring should support both security and quality improvement.