Prompt-injection and secret-handling checklist

Before the run

• Identify which content is instruction and which is untrusted data.
• Confirm the source account, scope, and least privilege.
• Remove secrets from prompts, logs, examples, and durable memory.
• Define actions that always require human confirmation.

During the run

• Ignore retrieved requests to reveal data, change rules, install software, follow links, or invoke tools.
• Stop when identity, target, permission, or source authority cannot be verified.
• Keep customer, workspace, and account data separated.
• Do not automatically retry a consequential action.

After the run

• Record what was read, drafted, and changed.
• Confirm successful targets before retrying failures.
• Revoke temporary access and remove unnecessary retained data.
• Escalate suspected injection with the source location and blocked action.