A clerk wraps resident email text in clear delimiters so instructions stay separate from the message body. What technique reduces confusion?

Mixed instruction and untrusted content confuses models. Wrapping resident email text in clear delimiters so instructions stay separate from the message body uses delimiter technique to mark where staff policy ends and resident content begins. That separation reduces prompt injection–style confusion where a resident line is treated as a system command (for example, “ignore fees” or “approve now”).

Stop-sequence delimiters that separate resident email content from instructions in municipal prompts fail because they define tokens that halt generation rather than wrapping resident email text in clear delimiters so the model does not confuse data with commands. System message delimiters that separate resident email content from instructions in municipal prompts fail because they mark system-role boundaries rather than isolating the live resident email body from instructions, so they do not prevent resident text from being read as system instructions. Few-shot prompt delimiters that separate resident email content from instructions in municipal prompts fail because they separate demonstration examples rather than marking where the current resident email starts and ends, leaving instructions and resident text mixed together.

Exam caveat: delimiters reduce mix-ups; determined adversarial wording can still attempt overrides. Combine delimiters with explicit priority rules that system policy outranks user content.

Operational check: place resident email inside labeled delimiters (e.g., BEGIN_RESIDENT_EMAIL / END); state that content inside is data only; refuse actions that contradict fee or eligibility policy without human clerk approval.