A permitting agent uses a RAG pipeline that ingests applicant-uploaded PDFs, and one uploaded document contains hidden text instructing the agent to bypass its review checklist. Which capability is designed to catch this before it reaches the model?
Select an answer to reveal the explanation.
Short Explanation
Hidden text buried in an uploaded PDF trying to hijack the agent's checklist is a prompt injection wearing a disguise, and you need a reader looking for that disguise before the content reaches the model. Model Armor is that reader, screening ingested content for injected instructions on the way in. Checking identifiers, version approval, or upload permissions are real controls, just not ones built to read for hidden instructions.
Full Explanation
Model Armor screens content for manipulation patterns, including injected instructions, which is exactly the threat a hidden-text prompt injection inside an ingested PDF represents; placing that screening between ingestion and the model is what stops the injected instruction from ever reaching the reasoning step where it could bypass the review checklist. Sensitive Data Protection scans for identifiers and sensitive data patterns in the uploaded document, which is a data-classification concern; a hidden instruction crafted to manipulate agent behavior isn't necessarily an identifier or sensitive-data pattern, so it would very plausibly go undetected by that kind of scan. Agent Registry checking whether the current agent version has an approved RAG configuration is a governance check about the pipeline's design, evaluated well before any specific document is uploaded, and it has no visibility into the content of any individual ingested file. Agent Identity confirming the applicant's upload permission establishes that the applicant is allowed to submit a document at all, which is an access-control question entirely separate from what that document's content contains once it's ingested. A scope caveat: content screening reduces but doesn't guarantee catching every injection technique, so pairing it with a checklist step the agent cannot skip regardless of instructions found in retrieved content adds defense in depth. As an operational check, the team can upload a test document containing a known injection pattern and confirm it is flagged before the RAG pipeline passes its content to the model.