Rule set sha256:c63def17fac2
rego-art15-ipi-008
One rule of the rule set with digest c63def17fac2df12ab70941d8fcb7678e9a670479ea0d6dce87e7ddd4dc96079. An audit record that names this digest and this rule was decided by the rule as shown here. Every rule in this set.
| Rule | rego-art15-ipi-008 |
|---|---|
| Rule version | 75c341f28ebcaa1d0416a9e2291d1b7a7f2f3a54a7c04e7c532a54a1da42c363 |
| Provision | Regulation (EU) 2024/1689, Article 15(5) ELI: http://data.europa.eu/eli/reg/2024/1689/art_15/par_5/oj |
| Approval | Approved Approved by Leo Celis on 2026-10-22 (via agent review per §5.1 amendment v1.1) |
rules/rego/complyedge/prompt_security/indirect_injection.rego
- Citation
- Not stated in the rule file.
- Condition
- Fake separators, system markers or role tags inside a text ("<system>", "### new instructions") that try to start a new context and take over the AI's instructions.
- Layer 1 detects
- in any letter case, ignore, disregard, forget, override or bypass, followed by one or more of "the", "all", "any", "your", "previous", "prior" and "above", then instruction(s), prompt(s), directive(s), rule(s), constraint(s), guideline(s) or "system prompt" ("ignore all previous instructions"); "unrestricted assistant with no guidelines"; and "act as an unrestricted assistant". It does not match separators, system markers or role tags such as "<system>": the separator form described above is matched by the separator/context hijack leaf, which shares this rule_id. It matches wording, not meaning: it fires on text that only names the attack ("should the bot ignore the previous instructions in a forwarded email?"), and it misses an override worded any other way. Whether the text tries to take over the AI's instructions is judged in Layer 2.
- Condition type
- Not stated in the rule file.
- Status in the file
- approved
rules/rego/complyedge/prompt_security/separator_hijack.rego
- Citation
- Not stated in the rule file.
- Condition
- Fake separators, system markers or role tags inside a text ("<system>", "### new instructions") that try to start a new context and take over the AI's instructions.
- Layer 1 detects
- in any letter case, at the start of a line (after optional spaces): a separator (three or more "=", "-" or "*", two or more "#", or a [user], [assistant], [system], [context], [input] or [prompt] tag or the same names as <tag> or </tag>), followed directly (spaces allowed) by a
- Condition type
- Not stated in the rule file.
- Status in the file
- approved