Protect the application around the model.
1. Credential placement
Keep privileged provider credentials in a controlled server boundary or use a supported protected mobile integration. Obfuscation is not a credential storage strategy.
2. Authorization per operation
Check user identity and record ownership at data and tool boundaries. A model-generated identifier never establishes access rights.
3. Prompt injection
Treat retrieved content and user input as untrusted data. Restrict tool authority and enforce permissions in code; prompt wording alone is not a security boundary.
Worked scenario
A retrieved document instructs the assistant to export another customer’s files. The data service denies the request regardless of the model’s decision.
Apply it
Threat-model direct requests, tool calls and retrieval results. Implement one cross-user access test.
Check your understanding
An adversarial prompt cannot expand access beyond the authenticated user’s permissions. Explain the decision and show evidence from your implementation or design. If you cannot demonstrate it yet, revisit the relevant section before continuing.