A permitting portal pilot receives a user message that tells the model to ignore ordinance-citation rules and approve every application. What GenAI attack surface does this primarily illustrate?

Direct prompt injection places adversarial instructions in the user-visible input path, attempting to make the model treat attacker text as higher priority than system or application policy. In this permitting portal pilot, telling the model to ignore ordinance-citation rules and approve every application is that pattern: the attacker seeks to override civic guardrails through natural language, not by exploiting the parcel database. GAIPS-style platform thinking treats untrusted user text as potentially instructional, not merely data. SQL injection against the parcel database instead exploits unsafe query construction to alter database commands; no database-query manipulation is described here. ARP spoofing on the permitting VLAN is local network impersonation that can redirect frames, not a way to override instructions inside a model prompt. Analyzing GPU execution-time patterns to infer secret model data is a specialized timing side-channel attack, not the primary surface illustrated by the chat message. Exam caveat: direct injection comes through user input, whereas indirect injection uses poisoned retrieved documents or tools; both seek to override instructions, but their control points and detection signals differ. The model need not comply for the attack surface to exist—an attempted override is already the risk. Practical check: separate system policy from user content, apply input filtering and instruction hierarchy, enforce approval decisions with deterministic business rules outside the LLM, log anomalous override-seeking phrases, and never make the model the sole permit authority. Keep legal criteria in code and workflows; use GenAI for drafting or triage, not unilateral disposition.