Security reviews RAG prompt templates for a permitting bot and finds retrieved context concatenated with no delimiter from user instructions. What structuring control reduces context/instruction confusion?
Select an answer to reveal the explanation.
Short Explanation
If the user's ask and the retrieved PDF mush into one blob, the model can't tell 'policy text' from 'do this now.' Fence them off—labels and delimiters—so instructions don't hide in the context.
Full Explanation
Clearly separating retrieved context from user instructions in the prompt template reduces confusion attacks against the permitting bot. When retrieved context is concatenated with no delimiter from user instructions, adversarial or accidental instruction-like text in documents—or crafted user text—blurs with system policy. Labeled sections, delimiters, and explicit rules that only the system block sets policy help the model treat retrieved PDFs as data and user text as untrusted instructions.
Removing all system prompts so only retrieved context remains fails by concept: that deletes the policy layer that should constrain the bot. Placing user instructions inside the retrieved-context block for “stronger grounding” fails by deliberately mixing trust levels and enabling override-by-context. Allowing retrieved documents to override system policy by design fails because untrusted or poisoned civic PDFs must not outrank security and privacy policy.
Exam caveat: Prompt structure is a control surface. Separate system policy, retrieved context, and user input for municipal RAG templates.
Operational check: Refactor templates with clear delimiters and roles, plant a fixture retrieved chunk that says “ignore privacy rules,” confirm the system policy still governs, fuzz user inputs that mimic system tags, and code-review templates in appsec.