Prompt injection is a model-behavior vulnerability. It becomes an authorization failure when manipulated output is allowed to read, modify, disclose, or trigger something the originating request should not control.
That distinction changes the control strategy. Prompts, content filters, and model guardrails can reduce manipulation. They cannot be the only enforcement boundary for high-impact actions because the same model behavior being controlled also produces the request.
Manipulation and effect are separate events
OWASP describes prompt injection as crafted or retrieved input that changes an LLM’s behavior and identifies outcomes including disclosure, unauthorized function access, arbitrary commands, and manipulated decisions. It also notes that impact depends on business context and the agency available to the model. OWASP LLM01:2025
Model the attack as a sequence:
untrusted input → model interpretation → tool request → authorization decision → resource operation → downstream effect
The injection occurs near the beginning. The security consequence can occur several enforcement boundaries later. A system that only searches prompts for malicious wording ignores the tool credential, policy, resource, and downstream effect that determine blast radius.
System prompts are instructions, not policy enforcement
A system prompt can tell a model never to send data externally. That instruction may improve behavior, but it does not provide the properties expected from an authorization system:
- a stable principal;
- a trusted policy source;
- deterministic evaluation of action, resource, and context;
- default deny when required facts are missing;
- explicit decision evidence;
- protection from alteration by the untrusted input being evaluated.
NIST/NCCoE’s agent identity concept work treats agent identification, authorization, delegation, logging, and transparency as system controls. NIST/NCCoE agent identity concept The agent may propose an action, but a separately governed component should decide whether the authenticated principal can perform that action on that resource under the current conditions.
Controls belong at multiple layers
| Layer | Control objective |
|---|---|
| Input and retrieval | Label untrusted content, constrain retrieval scope, and preserve provenance. |
| Model | Use clear task boundaries and reduce unnecessary instruction mixing. |
| Tool adapter | Expose narrow operations and validate typed parameters. |
| Authorization | Evaluate principal, delegated user, action, resource, context, and policy outside the model. |
| Resource | Enforce its own policy and invariants; do not trust the agent as the final authority. |
| Human approval | Show target, effect, evidence, and alternatives—not only model-generated persuasion. |
| Monitoring | Correlate the input, request, decision, effect, denial, and recovery. |
| Recovery | Revoke authority, stop queued work, reverse effects where possible, and verify state. |
OWASP’s agentic threat guidance similarly treats tool misuse and multi-step behavior as system-level risks rather than prompt-only problems. OWASP Agentic AI threats and mitigations
Worked indirect-injection example
An assistant reads a support ticket containing an instruction to upload diagnostic files to an attacker-controlled location. The model may interpret the text as part of its task and request an upload tool.
A secure architecture does not depend on the model recognizing the malicious sentence every time. The upload adapter accepts only approved destinations; authorization evaluates the service identity, tenant, destination, data classification, and user-approved purpose; the resource blocks cross-tenant access; and the event is recorded for investigation. The request is denied even if the model confidently explains why it is helpful.
This does not erase the injection. The manipulated model may still return misleading text or expose information already present in its context. It limits the path from manipulation to unauthorized effect.
What guardrails still do
Calling prompt injection an authorization problem does not make model-layer defenses irrelevant. Input isolation, retrieval provenance, instruction hierarchy, output schemas, model evaluations, content controls, and suspicious-trajectory detection can reduce attempts and improve signals. They should feed defense in depth, not inherit final authority over irreversible operations.
Practical takeaways
Assume untrusted content can influence model behavior. Limit the tools and credentials exposed, mediate every consequential operation outside the model, enforce policy again at the resource, preserve decision evidence, and test whether injected content can create an unauthorized effect—not merely whether the model repeats forbidden text.
Continue with Capability, Authority, and Reach and the AI agent threat-modeling Research to turn that boundary into testable controls.
Limitations
External authorization cannot prevent every confidentiality loss if sensitive data is already in the model context, and it cannot determine business correctness without trustworthy context. Some effects are difficult to reverse, and approval interfaces can be manipulated. Prompt-injection techniques and mitigations continue to change; no control set should be described as a complete solution.