Prompt injection in construction spreadsheets: separate formulas, instructions and import approval

A spreadsheet contains more than visible cells

A supplier workbook may include formulas, hidden sheets, comments, named ranges, external links and macros alongside prices and quantities. An AI system can also encounter text that looks like an instruction rather than business data. Treat the whole file as untrusted input. Inventory what the importer reads and what it ignores. Do not allow text inside a cell, comment or metadata field to override the system's task, request credentials or authorise an action.

Parse values and formulas into separate evidence

Show the displayed value, underlying formula and source cell for any amount that affects an estimate or quote. Recalculate with a controlled engine when feasible and flag unsupported functions, external references or circular logic. A model may explain a formula, but that explanation is not a verified calculation. Preserve the original file hash and a read-only snapshot so a reviewer can compare the proposed import with the supplier evidence.

Keep interpretation separate from import

Use a staged workflow: extract, classify, compare, review conflicts and only then apply approved rows. The AI can propose column mappings or highlight suspicious instructions, while the business application enforces schema, permissions and confirmation. Never let a spreadsheet trigger email, pricing updates, supplier changes or project actions merely because a cell asks for it. Limit the import identity to the exact destination and require a new confirmation when mapped totals or conflicts change.

Test adversarial and ordinary failure cases

ENISA materials recognise prompt injection and adversarial manipulation as AI-specific security concerns. Test hidden instructions, a formula returning text, an external link, a renamed unit column, duplicate item codes and a normal spreadsheet with one typo. The safe result is a reviewable exception, not a confident guess. Keep logs of ignored instructions and human decisions without exposing the full workbook to people who do not need access. This protects both security and estimating accuracy.

Turn the decision into a controlled workflow

Do not leave this control in an isolated note. Record who checks the inputs, which source supports the decision, which exception requires human review and who confirms the final action. Enfin can bring customer, project, quote and invoice context together, while Alfie can prepare or execute actions within verified permissions. That is not a substitute for legal or tax advice, but it makes the contractor's control repeatable. Explore Enfin, review pricing, or discuss the workflow.