/ ENGINEERING SYSTEMS
Back to Field Notes

FIELD NOTE / SECURITY NOTE

Retrieved text is evidence—not authority

2 min readUpdated 2026-08-29

Retrieval improves an application's context, but it also introduces another stream of untrusted content. A document that appears in a search result should not gain the ability to rewrite policy or authorize an action.

Public-safe engineering note · no client or confidential implementation details
01

Separate instruction classes

System policy, application rules, user requests, retrieved passages, and tool responses have different trust levels. Keeping them visibly separate in the orchestration layer makes it possible to apply different validation and handling rules. Flattening everything into one prompt makes provenance and authorization harder to reason about.

02

Validate before context assembly

Documents should pass access checks, freshness rules, metadata filters, and content-safety checks before they enter a model context. Retrieved text can be relevant and still contain a malicious instruction. The safe response is to preserve the evidence needed for an answer while excluding instructions that are not part of the document's informational role.

Share a thought

Comments appear immediately. Email is optional and never shown.

Markdown & code fences supported
AUTH VIA: PUBLIC FORM

No comments yet. Be the first to share a thought.

01 / SYSTEM VIEWInspect the architecture Follow a request through retrieval, validation, and audit.02 / EVIDENCEReview the case studies See the engineering decisions and measured outcomes.03 / OPEN CHANNELStart a conversation Talk through a production GenAI problem.

KEEP READING

Systems referenceLLM Tool Calling: The Complete Field ReferenceA decision-first reference for reliable tool definitions, parallelism, failure handling, provider adapters, argument validation, and multi-turn agent loops.Production accountWhat Actually Happens When You Fine-Tune an LLM on 12,000 Domain Samples: A Production AccountA granular account of QLoRA on Llama 3 8B: the failed runs, the measured gains, the serving surprises, and why fine-tuning was not the system bottleneck we thought it was.Security dossierPrompt Injection: The Vulnerability Baked Into the Architecture of Every LLM Application You Will Ever BuildA structural investigation of mixed-trust context, indirect injection, partial defenses, privilege separation, and the residual risk that cannot be patched at the model layer.