Treat Retrieved Content as Data, Not Instructions

A RAG pipeline may retrieve a relevant document that contains imperative language. A tool response or imported webpage can do the same.
If every string enters the prompt with the same apparent authority, the model must infer which content represents policy and which content is only evidence.
Build a structured context assembler. Label trusted application instructions separately from user input and external content. Preserve source IDs, limit included material, and keep provenance available for review.
VectorNode is our product. Its public page describes one-key access to GPT, Claude, Gemini, DeepSeek, Qwen, Midjourney, Kling, and other models, together with unified credits, transparent pricing, and usage logs. It can sit behind an application-owned context boundary: https://www.vectronode.com
Disclosure: VectorNode is our product, and this link is included for readers who want to explore it.
Prompt separation is helpful, but sensitive actions still need code-level enforcement. The application should allowlist tools, validate arguments, check authorization, and decide whether a proposed action may run.
External content does not always need to be discarded. It needs to remain clearly identified as data rather than application authority.
No single prompt structure removes every injection risk. Test the complete workflow with representative documents, tools, and action policies.