Phase 3 — Core AI Engineering · Lesson 37 · 20 XP
Guardrails and prompt injection
Prompt injection is the core security risk of RAG and agents: untrusted content — a retrieved document, a web page, a tool result — contains instructions aimed at the model, trying to override its actual task. A plain chatbot only ever sees what the user typed; a RAG or agent system feeds it content from outside sources it doesn't control.
Guardrails reduce this risk without eliminating it: explicitly instructing the model to treat retrieved or tool content as data, not instructions; filtering suspicious content before or after the model sees it; and limiting what tools are actually allowed to do, so even a successful injection has a small blast radius. PII handling follows the same logic — decide upfront what should never be logged or sent to a third party.
Exercise
Deliberately construct a prompt-injection test case — a fake "document" containing hidden instructions — against your Lesson 29-30 RAG pipeline and observe what happens. Add one guardrail (e.g. an explicit system-prompt instruction, or output filtering) and confirm it measurably reduces the effect.
Check yourself
1. Why is prompt injection especially dangerous in a RAG or tool-using agent, compared to a plain chatbot?
2. Name one concrete guardrail you could add to reduce — not eliminate — that risk.
Observability and tracing
Answer the check-yourself questions to unlock this