Prompt injection: inspect the trust boundaries

What this experiment demonstrates

An injected instruction can influence a model without producing a harmful effect if the surrounding application enforces the right boundary. This experiment separates the source, model proposal, resource authorization, tool effect, and final release. The source selector changes the representation of untrusted material, not its authority. A document, tool result, summary, and OCR text all remain data unless the application deliberately grants them another role.

The model-following switch is an explicit assumption. The page does not run a language model or estimate jailbreak success. Turning it on says that this fixture has already produced an unsafe proposal, allowing you to inspect whether the application contains it. This makes the exercise about enforceable consequences rather than a fictional detector-accuracy score.

Run a controlled comparison

Start with Cross-tenant read and all controls enabled. The ownership boundary blocks the request before any private record is returned. Turn off resource ownership while leaving final-output blocking on. The unauthorized-read metric becomes one even though the user-output-leak metric remains zero. A later output check has prevented one disclosure channel but has not undone the earlier access violation.

Next choose Private-data export. Turn outbound destination policy off and observe the disclosure. Changing the final-output switch does not reverse a completed outbound action. Restore the destination policy and verify that the effect is blocked. Finally select Legitimate summary to confirm that the controls still permit useful work under this fixture.

Inspect each decision and retain the evidence

Use Start trace to hide the decision steps, Next step to reveal one at a time, and Show all to return to the complete sequence. The step slider lets you revisit a boundary without changing the experiment inputs. Metrics always describe the complete run, as stated beside the slider; they are not partial cumulative counts. Reset restores the baseline assumptions. Export JSON downloads the inputs and modeled outcome locally so you can compare two runs.

For each comparison, write down the protected effect, the earliest check that had enough evidence to stop it, and the check that was too late. This is the same reasoning you would apply when placing ADK callbacks or backend service checks.

Limits and production translation

The fixture assumes perfect ownership and destination checks when enabled. It does not model identity-provider failures, DNS behavior, real documents, provider safety filters, or network traffic. The final-output check recognizes only the synthetic private record in this exercise. Real systems need independent authorization, safe rendering, coverage evaluation, and incident procedures.

Translate the experiment into a service test by using invented tenants and a fake outbound adapter. Assert that denied reads return no rows and denied exports make no network request. A polite refusal is not sufficient evidence. The resource service and release boundary must show what actually happened.