A purple team comparing paths into a permitting assistant needs to distinguish injection types. Which contrast is correct?

For a permitting assistant, the useful contrast is direct prompt injection via the user chat channel versus indirect injection via untrusted documents or retrieved content that later enters model context. Both can override or steer behavior, but they enter through different trust boundaries and therefore need different controls: chat input validation and session policy versus document sanitization, KB integrity, and retrieval mediation. Correct purple-team mapping uses that distinction to assign owners and test cases. Describing direct injection as hidden malicious tool output versus indirect injection via administrator system prompts may describe model risks, but it doesn't supply the direct-versus-indirect entry-path distinction the purple team actually needs for the permitting assistant. Claiming direct injection comes through retrieved permit PDFs while indirect injection comes through typed chat requests reverses the channels and erases a diagnostically important path difference for remediation. Framing the contrast as jailbreak refusal bypass versus training data poisoning confuses runtime entry paths with attack techniques and pre-deployment compromise—indirect injection works precisely because the attacker never needs to touch the server at all. Exam caveat: many real civic incidents combine paths (e.g., a user uploads a document that is later retrieved); still classify primary entry for each finding. Operational check: maintain separate test suites for chat-channel overrides and document/RAG-channel overrides on the permitting assistant, tag findings by path, and verify controls exist on both the conversational and knowledge ingestion boundaries.