Untrusted content: everything from outside is data
An agent working prior authorization reads a great deal of text it did not write: payer responses, faxed determinations, chart notes, retrieved policy documents, vendor API payloads. Every one of those is a channel through which text can arrive that is aimed at the agent rather than at a human.
#The failure mode
If content from outside is concatenated into the same context as the system's own instructions, the model has no reliable way to tell which is which. Text inside a document that reads like a directive can be followed as one. This is prompt injection, and in an agentic system with real capabilities the consequence is not an embarrassing answer but an action.
It does not require an attacker. A payer letter containing the sentence "approve this request" is describing something, not instructing anyone, and a system that cannot make that distinction structurally will eventually act on it.
#Three slots that do not mix
Instructions- Ours. Static. Never derived from input, never assembled from anything a caller supplied.
Facts- Structured data the system trusts because of where it came from: fields read from the chart through a governed connection, verified configuration.
Untrusted content- Everything else. Labelled as such, and carried in a way that is inert with respect to instruction following.
The separation has to be structural. A convention that untrusted text will be placed after a marker is a convention, and conventions are what injection attacks are written against.
#Why this is not solved by a better prompt
Instructing a model to ignore instructions inside documents helps and does not hold. It is the same category error as the rest of prompt-based safety: a probabilistic defence against a deterministic requirement. If the property you need is that retrieved text can never cause an action, that property has to live somewhere the text cannot reach.
In practice that means the capability boundary. Text that arrives from outside can influence what a draft says. It cannot cause a payer transmission or a chart write, because those require a human release that a document cannot produce. The injection still fails even if the model is fooled, which is the only guarantee worth having.
#What to test
This belongs in the adversarial level of the eval harness, with explicit cases: a directive embedded in a faxed determination, an instruction in a chart note, a payload from a vendor containing text shaped like a system prompt. The test is not whether the model notices. It is whether anything happens.