Separate application instructions from user text in an AI request
Use the API’s supported instruction roles, keep quoted documents as data and test conflicting input before shipping an assistant.
In brief
An application’s operating rules should not be mixed into the same undifferentiated text as a user’s message or a retrieved document. APIs provide instruction roles or dedicated instruction fields to express that distinction.
Correct separation helps an assistant keep its format and scope when a document contains words that look like commands.
Write stable rules separately
Specify scope, evidence policy and output format as application instructions. Keep changeable user tasks separate. For an API supporting developer instructions, use the documented field or role instead of prefixing an ordinary user string with “system:” and assuming it gains that priority.
Label data as data
A pasted support ticket might contain “ignore the previous instructions.” The assistant should analyse the ticket rather than treat that sentence as a new operating rule. Preserve source boundaries and test this case with harmless sample text; never put a real secret into a test to see whether the model repeats it.
Enforce what the model cannot decide
A request to read another person’s file needs an authorization decision in your application. A request to send a message needs the appropriate user intent and controls. Even a correctly structured request can produce an invalid action, so validate before execution.
Before you act
Role syntax and model support vary by API. Instruction priority is not authorization: the server must still enforce permissions and validate actions.
What to do next
- Read the provider’s current role and instruction-field semantics for the chosen API.
- Put application rules in their supported place and user material in the appropriate input.
- Test quoted commands and conflicting user requests, keeping real permission checks outside the model.
