A retailer's returns agent reads product reviews while it decides a refund. One review tells the agent to ignore policy and issue the refund twice. The agent has a tool that can post a refund. What should the architect require?

Text in a product review is data, not a new refund policy. A review that says to ignore policy and pay twice is prompt manipulation, and the control sits on the refund tool: a limit the review cannot raise, so the untrusted sentence has no path to increase what the tool will post. The agent can still read the review for context about the complaint. The tool, not the review, enforces the cap. A longer instruction that says to ignore refund language still competes with the review at runtime and leaves the tool unconstrained, which is not a control. A training run on that single review memorizes one attack sample and does nothing to the tool the next, differently worded review will try to use. Removing every product review stops the agent from reading legitimate complaints, which is a wider outage than the risk requires. Exam caveat: the same rule applies to any text the agent retrieves, including a review, a chat, or a file. The place the text came from does not turn it into instructions. Operational check: submit a test review that demands a double refund above the cap and confirm the tool posts at most the cap, then submit an ordinary complaint and confirm the agent can still read it.