Treat Retrieved Text as Evidence, Not Permission

A retrieved document can contain instructions that have nothing to do with the user's task. Its presence in a tool response does not give it authority.

Use a synthetic search result that contains both a relevant fact and a sentence telling the assistant to change unrelated records. Test whether the workflow uses the fact while keeping tool access and authorization within the original task.

Do not rely on a prompt warning alone. Limit available tools, validate their arguments and require the appropriate approval for external effects. Keep the test in your evaluation set when changing the model or retrieval source. The desired outcome is useful evidence handling with the same action boundary, even when the retrieved material is untrustworthy.

OpenAI documentation.