Rule set sha256:c63def17fac2
rego-art15-ipi-003
One rule of the rule set with digest c63def17fac2df12ab70941d8fcb7678e9a670479ea0d6dce87e7ddd4dc96079. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-art15-ipi-003 |
|---|---|
| Rule version | c7bbac0b74abd4922cd0a81ffb990fa8cf83ee060bdabcb9f6fa308218bec4ce |
| Provision | Regulation (EU) 2024/1689, Article 15(5) ELI: http://data.europa.eu/eli/reg/2024/1689/art_15/par_5/oj |
| Approval | Approved Approved by Leo Celis on 2026-10-22 (via agent review per §5.1 amendment v1.1) |
rules/rego/complyedge/prompt_security/embedded_instruction.rego
- Citation
- Not stated in the rule file.
- Condition
- An instruction hidden in content an AI processes (a document, email, page or tool result) that tells it to ignore its user and do something else.
- Layer 1 detects
- in any letter case, "when you" followed by summarize, summarise, read, process, analyze, analyse or parse, then "this"; "system:" followed by "new instructions"; an opening "<system>" tag, with or without spaces inside the brackets; and "ignore the user and instead". It matches wording, not meaning: it does not read who wrote the text, so it fires on the user's own request in the same form ("When you summarize this, keep it to three bullets") and on any text that quotes a <system> tag, and it misses an embedded instruction worded any other way. Whether the text carries a third party's instruction is judged in Layer 2.
- Condition type
- Not stated in the rule file.
- Status in the file
- approved
rules/rego/complyedge/prompt_security/indirect_embedded.rego
- Citation
- Not stated in the rule file.
- Condition
- An instruction hidden in content an AI processes (a document, email, page or tool result) that tells it to ignore its user and do something else.
- Layer 1 detects
- in any letter case, "when you", "when the AI", "when the assistant", "when the model" or "when the LLM", followed by read, process, summarise, summarize, analyse, analyze or parse (with or without a final "s"), then "this", then, within the next 60 characters on the same line, ignore, instead, "you must", "do not" or disregard; a line that starts (after optional spaces and one to three "#") with "system" or "assistant" followed by message, prompt, instruction or note, then a colon or ">"; and an opening "<system>", "<important_instruction>" or "<important_instructions>" tag, with or without spaces inside the brackets. It matches wording, not meaning: it does not read who wrote the text, so it fires on the user's own request in the same form ("When you read this, do not skip the appendix") and on a document line that begins "System note:" for an ordinary reason, and it misses an embedded instruction worded any other way. Whether the text carries a third party's instruction is judged in Layer 2. Deterministic OPA/Rego leaf so this indirect/direct prompt-injection pattern blocks on the /v1/check hot path (previously YAML/TrustLint only, retired from /v1/check). Pattern ported from the universal YAML rule named below; that rule has since gained alternatives this leaf does not carry, so the two patterns no longer match.
- Condition type
- Not stated in the rule file.
- Status in the file
- approved