Rule set sha256:026d59ecf618

rego-art15-ipi-003

One rule of the rule set with digest 026d59ecf6186f63d5f16b503c9429b896cee28ca509559704824e11f4530007. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.

rules/rego/complyedge/prompt_security/embedded_instruction.rego

Citation
Not stated in the rule file.
Condition
An instruction hidden in content an AI processes (a document, email, page or tool result) that tells it to ignore its user and do something else.
Layer 1 detects
in any letter case, "when you" followed by summarize, summarise, read, process, analyze, analyse or parse, then "this"; "system:" followed by "new instructions"; an opening "<system>" tag, with or without spaces inside the brackets; and "ignore the user and instead". It matches wording, not meaning: it does not read who wrote the text, so it fires on the user's own request in the same form ("When you summarize this, keep it to three bullets") and on any text that quotes a <system> tag, and it misses an embedded instruction worded any other way. Whether the text carries a third party's instruction is judged in Layer 2.
Condition type
Not stated in the rule file.
Status in the file
approved

rules/rego/complyedge/prompt_security/indirect_embedded.rego

Citation
Not stated in the rule file.
Condition
An instruction hidden in content an AI processes (a document, email, page or tool result) that tells it to ignore its user and do something else.
Layer 1 detects
in any letter case, "when you", "when the AI", "when the assistant", "when the model" or "when the LLM", followed by read, process, summarise, summarize, analyse, analyze or parse (with or without a final "s"), then "this", then, within the next 60 characters on the same line, ignore, instead, "you must", "do not" or disregard; a line that starts (after optional spaces and one to three "#") with "system" or "assistant" followed by message, prompt, instruction or note, then a colon or ">"; and an opening "<system>", "<important_instruction>" or "<important_instructions>" tag, with or without spaces inside the brackets. It matches wording, not meaning: it does not read who wrote the text, so it fires on the user's own request in the same form ("When you read this, do not skip the appendix") and on a document line that begins "System note:" for an ordinary reason, and it misses an embedded instruction worded any other way. Whether the text carries a third party's instruction is judged in Layer 2. Deterministic OPA/Rego leaf so this indirect/direct prompt-injection pattern blocks on the /v1/check hot path (previously YAML/TrustLint only, retired from /v1/check). Pattern ported from the universal YAML rule named below; that rule has since gained alternatives this leaf does not carry, so the two patterns no longer match.
Condition type
Not stated in the rule file.
Status in the file
approved