FIELD NOTE / SECURITY NOTE
Retrieved text is evidence—not authority
Retrieval improves an application's context, but it also introduces another stream of untrusted content. A document that appears in a search result should not gain the ability to rewrite policy or authorize an action.
Separate instruction classes
System policy, application rules, user requests, retrieved passages, and tool responses have different trust levels. Keeping them visibly separate in the orchestration layer makes it possible to apply different validation and handling rules. Flattening everything into one prompt makes provenance and authorization harder to reason about.
Validate before context assembly
Documents should pass access checks, freshness rules, metadata filters, and content-safety checks before they enter a model context. Retrieved text can be relevant and still contain a malicious instruction. The safe response is to preserve the evidence needed for an answer while excluding instructions that are not part of the document's informational role.
Never let evidence grant authority
A retrieved passage should not be able to request secrets, change tool permissions, override a policy, or redirect data to an external destination. Those decisions belong to deterministic policy and authorization code. The model can help interpret evidence; it should not promote evidence into authority.
Make the decision auditable
A useful trace records which sources were retrieved, what filters applied, which content was quarantined, which policy version made the decision, and whether the final answer was grounded. Redact sensitive payloads and retain only what a reviewer needs to reconstruct the control path.