The engineer drafting the charter-desk assistant's prompt writes the retrieved clause text directly into the same message as the user's question, with no labels distinguishing which part is retrieved context and which part is the user's actual question. What risk does this design choice introduce?
Select an answer to reveal the explanation.
Short Explanation
Without clear labels saying 'this part is the document, this part is the question,' the model has to guess where one ends and the other begins - and if the retrieved clause text happens to contain something that reads like an instruction, an unlabeled prompt makes it easier for the model to mistake it for one.
Full Explanation
Failing to clearly delimit retrieved context from the user's actual question or instructions increases the risk that the model treats content embedded in the retrieved text as if it were an instruction from the user or the system, which is a form of prompt-injection exposure and a general misinterpretation risk - clear labeling (e.g. explicit 'CONTEXT:' and 'QUESTION:' sections or delimiters) is a basic, well-established defensive practice for exactly this reason. Claiming the model can always tell context from questions without labels is false; unlabeled concatenation is a known source of instruction confusion, which is precisely why structured prompts separate roles and sections. The claim that this guarantees exceeding the context window is unrelated - whether text is labeled or not has no bearing on total token count, only on how the model interprets the tokens it receives. The claim that it disables citations is also unrelated - citation capability depends on whether source identifiers are tracked and surfaced, not on whether context and question are visually delimited in the prompt. This item tests applied, defensive awareness of prompt-injection risk at the design level, which the brief explicitly calls for without requiring any actual attack payload.