THE STARTING POINT
Three things to get right.
- Separate instructions from untrusted documents and tool results.
- Give each tool the smallest useful permission set.
- Record tool calls and evaluate failures alongside successful runs.
TRY THIS WITH YOUR CUSTOMER
A question worth testing.
Customer objective: demonstrate why retrieved content must not grant tool permissions. Use a synthetic document-search assistant, introduce an untrusted instruction, and compare the model response with the application’s authorization decision.
Open the workshop guideGive the customer a useful takeaway.
Start with a customer question and a clear success criterion. Capture the baseline, observed behavior, and evidence, then explain what the result means and which question to investigate next.