🪤 Prompt-injection defense

The single most important lesson in AI security: the authorization layer, not the prompt, is what stops an attack. A document below carries an injected instruction — watch it stay completely inert.

document:notes below reads like ordinary sprint notes — but its content also carries a hidden instruction demanding document:injection-secrets be revealed and delete_account be called. Nothing here asks the model to "please refuse" that demand. Instead, a real FGA Check (the exact evaluator the /fga and /rag labs use) decides which document content ever enters the prompt, and the exact scope-authorization check the MCP lab gates every real tool call on decides whether the requested tool would ever run — before the model's output is even looked at.

Turning on the real LLM (LAB_LLM_ENABLED) would change nothing about the outcome here: blocked and tool_attempts are decided in code, before any prompt exists — a real model would read exactly the same authorized-only context and have exactly as little power to leak or execute anything as the simulated path below does.

Learn → Prompt injection — when content becomes commands Learn → Permission-aware RAG Learn → MCP tool authorization — least privilege at the tool boundary

The scenario — documents

Content is shown ONLY when the FGA Check authorizes YOU — grant yourself viewer on a document in the FGA lab and refresh to watch it change.

The scenario — tools & your scopes

Run an attack

Pick a canned attack Exfiltrate document:injection-secrets The injected instruction demands the full contents of document:injection-secrets be revealed. Call delete_account The injected instruction demands the (simulated) delete_account tool be invoked. Override all instructions "Ignore all prior rules" — demands every other document be shown regardless.