Treat retrieved instructions as data: Which design best meets those constraints?
Retrieved text remains data, while restricted tools, validation, and human approval prevent it from directing consequential behavior.
The question
A housing administrator uses retrieval-augmented AI to summarize applicant documents. A retrieved document contains instructions aimed at changing the system’s decision behavior. The administrator must preserve relevant applicant evidence, prevent document text from authorizing actions, and require human review for consequential recommendations. Which design best meets those constraints?
Preparing for AIGP? Take the free 5-min readiness quiz →
- Treat retrieved instructions as data, restrict tools, validate outputs, and require human approval. ✓This design preserves source evidence while separating data from instructions, limiting permissions, validating outputs, and retaining consequential human oversight.
- Place a stronger system instruction above retrieved documents and retain unrestricted tools.Instruction hierarchy may reduce some attacks, but unrestricted tools leave authorization exposed and do not ensure output validation or approval.
- Ask applicants to certify that submitted documents contain no instructions to the AI.Applicant certification cannot reliably detect embedded instructions and does not control tool permissions, output validation, or review requirements.
- Exclude all retrieved documents from the system’s context.Excluding documents prevents prompt injection through retrieval, but also removes evidence needed for accurate applicant summarization and review.
The trap
Treat retrieved instructions as untrusted data; pair that separation with technical permission limits, validation, logging, and human approval. How to remember it
Retrieved text remains data, while restricted tools, validation, and human approval prevent it from directing consequential behavior.
How many of these would you get right?
One of 1581 AIGP questions on Certsqill. Take a free five-minute check and see your score per domain — not one number, but which section to open tonight.
Test your AIGP readiness — freeMore Understanding How to Govern AI Deployment and Use questions
- Revoke the agent’s booking permission and preserve action: What should the operator do first? →
- Tokenize identifiers: Which approach best satisfies both constraints? →
- Publish a preliminary factual notice describing: What should the organization do first? →
- All 424 Understanding How to Govern AI Deployment and Use questions →
Part of the Certsqill AIGP question bank · Understanding How to Govern AI Deployment and Use ·
Every answer, right and wrong, comes with its own explanation.
