Documents that give the vault orders
A document is content, never a command. Anyone can upload a file that
says "ignore your instructions" somewhere inside it — a hostile
colleague, a compromised mailbox export, or simply a document ABOUT
such attacks — and the vault's answer engine will later read documents
aloud to a model to answer questions. The vault therefore treats every
document, and everything a model writes back, as untrusted text, in
layers: what holds the wall up is structure (the model only ever sees
passages the asker may read, can only cite what it was given, and can
only answer — never act), and on top of that sit the screens: a
deterministic scan that quarantines imperative embedded instructions, a
length bound on questions, an optional second model that flags suspect
documents for a person to review, and hygiene over every answer before
anyone sees it. A screen can miss; the structure does not move.
A question longer than the vault accepts is refused readably
- Given a vault that accepts questions up to a configured length
- When somebody asks a question past that length
- Then the vault refuses before any model or document is consulted
- And the refusal names the limit and never repeats the question
A document ordering the vault around is quarantined at the gate
- Given the text of a document that tells an AI to ignore its instructions
- When the content screen reads it
- Then the document is quarantined for review, not stored
A document that merely discusses attacks passes the gate
- Given the text of a document that talks about prompt injection without giving orders
- When the content screen reads it
- Then the document passes the deterministic screen
A document the screening model flags waits for a person
- Given a screening model that answers YES about a document
- When the auditor screens that document
- Then the verdict is a flag for human review, never a silent verdict
A screening model that cannot answer holds the document
- Given a screening model that is unreachable
- When the auditor screens a document
- Then the document is held rather than passed unscreened
A model echoing the vault's own scaffolding is tidied visibly
- Given a model answer that echoes the passage fence into its text
- When the answer is prepared for the reader
- Then the echoed scaffolding is replaced by a visible marker, never kept and never silently dropped
A question nothing answers is declined without asking a model
- Given a caller whose readable passages contain nothing relevant
- When they ask their question
- Then the vault says its corpus does not cover it, and no model was consulted