Prompt injection in construction documents: treat files as untrusted input

A document can contain data and instructions

An AI system may read tender specifications, supplier invoices, spreadsheets and site reports. Most text is business content, but a file can also contain language telling the model to ignore rules, reveal information or trigger an action. Those words are not authorised merely because they appear inside a document.

Define a trust boundary before intake. The user request and the application's action policy are instructions. Uploaded document text is untrusted evidence. Parse it for fields and meaning, but never let it change permissions, tools, recipients or confirmation requirements.

Separate extraction from execution

First store and scan the original file. Extract proposed facts with page, sheet or row references. Show low-confidence values, hidden content, external links and conflicting instructions. A supplier invoice can propose an amount and project reference; it cannot authorise its own approval or payment.

Use typed actions rather than letting the model invent an API call. Validate every parameter against the organisation and current object state. Check that the user has the required capability. For sensitive writes, present an understandable confirmation containing the real object and effect.

Limit what document-processing tools can reach

Give the extraction process only the files and records needed for the task. Do not expose unrelated customer, employee or financial data in the same context. Avoid automatically fetching URLs found inside a document. If a link must be opened, route it through separate security controls and make the origin visible.

Treat spreadsheets and archives with additional care: hidden sheets, formulas, macros and nested files may contain content users cannot see in a preview. Convert or sandbox where appropriate and reject unsupported formats instead of guessing.

Log attempts and safe failures

Record the file identifier, extraction step, proposed action, policy decision and result without copying unnecessary sensitive text into logs. When the model encounters instruction-like content, keep the business task available but flag the segment for review. A safe rejection should explain what the user can do next.

Test with realistic adversarial documents: instructions in white text, image captions, spreadsheet cells, translated clauses and fake confirmation phrases. Verify that read-only analysis stays read-only and that no channel bypasses the normal action contract.

Govern the model provider separately

Prompt-injection controls do not answer privacy and retention questions. Review the exact service and configuration. OpenAI documents endpoint-specific retention and Zero Data Retention eligibility; Anthropic distinguishes default commercial API retention from separately approved zero-retention arrangements. Do not infer a guarantee from a model name.

Enfin's Alfie architecture uses typed actions, permissions and confirmations around business context. Learn how to evaluate governed construction agents, manage construction document security and review AI document intake.

Sources: current Alfie action policy, contracts and permissions; OpenAI API data controls; Anthropic zero-retention scope, checked 1 August 2026.