PRODUCTION SCENARIO
An accounts-payable agent reads inbound vendor emails and files invoices. A penetration tester sent an email whose body told the agent to change the payee bank account, and the agent complied. The pipeline currently pastes each email body into the system prompt before the run.
Where should the email body be placed so the model treats it as data rather than instructions?
Answering here is anonymous. Nothing is saved unless you sign in.
Show answer and explanation
Answer: In a source-labeled tool_result block, under a policy that tool content never overrides instructions
The Claude guardrail docs say to deliver third-party content inside tool_result blocks, never in system prompts or plain user text blocks, because the model is trained to treat instructions that appear inside tool results with skepticism. The same page warns against putting your own instructions in tool results, since they may be ignored or flagged as a potential injection.