Keep instructions inside HVAC attachments out of your AI workflow

Define what the assistant is allowed to extract

A supplier PDF or customer spreadsheet may include ordinary facts alongside text telling an assistant to ignore rules, open another site or send information. Establish a narrow extraction task before supplying the file: approved fields, required source references, allowed output and the person who reviews it. Use an approved environment and only the information necessary for that task.

Do not give the extraction step permission to send messages, open arbitrary links, modify records or run commands. A prompt can help explain the boundary, but a written instruction alone is not a complete technical defense. Tool permissions, document handling and review procedures matter as well.

Test a fictional supplier attachment

Suppose a material quote contains ordinary line items plus a note instructing an assistant to email the full customer list to a verification address. The legitimate extraction is the quote number, item references, prices and validity stated in the approved task. The embedded request is untrusted content and should be isolated for review without executing it. Do not contact the address to investigate.

Use a separate exception record containing file reference, location of the suspicious instruction, requested action, whether any action occurred and responsible reviewer. Avoid copying unnecessary harmful text into other automated workflows. If the document’s integrity is uncertain, pause its use and route it through the organization’s established security process.

Check the output before downstream use

Compare extracted fields with the original document and confirm that the assistant did not add external recipients, hidden actions or unsupported facts to its output. Keep the review stage separate from any later authorized quoting or purchasing operation. An apparently correct table does not prove the whole workflow resisted the embedded instruction.

Use fictional test files to cover a plain quote, an obvious malicious instruction and an ambiguous request requiring a human decision. Record what was actually observed; do not label a single successful test as secure certification. If the workflow needs external tools later, add only the specific approved capability and test that boundary again. This guide does not authorize testing against real customer systems.

Release checklist

• Specify permitted extraction fields in advance.
• Keep external actions unavailable during extraction.
• Record suspicious action requests without executing them.
• Review evidence and observed behavior before downstream use.

Source context and limits

NIST’s generative-AI profile discusses information-security risks including prompt injection. Our proposed extraction boundary is one operational precaution, not a complete defense, security certification or report of adversarial testing.