A site-maintained architecture view connecting how untrusted content enters an AI application, may influence a model, and is either stopped or allowed by application-owned controls. It is not a standard or universal pipeline.
No single trust score can safely replace these separate facts and decisions.
| Concept | What it establishes | What it does not establish |
|---|---|---|
| Source and authenticity | Where content came from and whether an identity or channel check passed. | Instruction authority, correctness, trust or permission. |
| Relevance | How well content matches a query or task. | Trust, integrity or authorization. |
| Instruction priority | How a model is expected to rank competing instructions. | A deterministic application boundary. |
| Model influence | That input changed model behavior or output. | Execution, disclosure, modification or confirmed impact. |
| Authorization | Whether an exact resolved action is permitted under policy. | Whether content is true, benign or trusted. |
| Information flow | Whether classified data may move from a source to a sink. | Network reachability or action permission by itself. |
| Network reachability | Whether an approved network path to a destination exists. | Action authorization or information-flow permission. |
| Execution and result state | The observed state of submission, execution and result. | Intent or full downstream impact without further evidence. |
| Security impact | Observed effects on confidentiality, integrity, availability, resources or business state. | Follow merely from model influence, a proposal or an alert. |
This example uses only the reserved domain example.test. It illustrates state separation without a reusable payload or real target.
A support assistant fetches a ticket-linked page at status.example.test; the page is external data.
The application records the URL and fetch time, labels the page untrusted, and places an excerpt beside trusted task instructions.
Instruction-like page text causes the model to suggest sending a diagnostic summary elsewhere. This establishes influence only.
The application resolves a draft send action with destination, selected fields and initiating user. Nothing has been sent.
Authorization rejects the destination; IFC also rejects releasing ticket data there. No detector result can override either decision.
No tool call is submitted. The state is denied before execution, not failed execution and not unobserved.
Logs preserve the fetch, proposal and two denials. They support model influence and prevented release, not compromise or data disclosure.
These records illuminate different parts of the map. Their original evidence classifications remain unchanged.
Shows a reported email-to-context-to-exfiltration path; the record states no known in-the-wild exploitation.
Research demonstrationSlack AIDemonstrates a retrieval-mediated data path under research conditions, not a confirmed real-world breach.
Vendor advisoryAWS-2025-019Documents vendor-reported prompt injection issues and remediation; it is not evidence of known exploitation in the wild.
Use a Learning Path for an ordered course, or open Labs for preset client-side educational simulations.