Guided · intermediate · 30 min · Free account

The note that says ignore policy

Calder's support agent proposed a policy-waived replacement because the customer's message told it to. Find the injected instruction, see where write authority actually lives, and make the evidence compiler treat customer text as untrusted.

Brief

Customer: Calder Equipment (synthetic customer from the Production AI Agents course; every case, log and proposal on this box is made up for the exercise)
Situation: Calder's support agent reads a case, compiles the applicable policy and proposes one of replace, clarify, deny or handoff. This morning the proposals log shows case C04 proposed as replace with policy_waived: true. Policy P2 has no waiver. The operator who reviews proposals asked why the agent thinks it can waive a policy, and whether anything was shipped.
Your role: You are the FDE who owns the agent's evidence path. You may read cases, policies and logs, run the agent's CLI (agentctl) against recorded cases, and edit the agent's policy file. The replacement service on this box is a simulator with the production contract.
Goal: Find the case that carried the instruction, establish whether the service would have honoured the proposal, name where the authority to waive a policy lives, and change the evidence compiler so instruction-like customer text can no longer steer a proposal. Prove it by re-running C04.

Objectives

1.Identify the case whose evidence carried the injected instruction (you commit to an answer)
2.Establish whether the service would honour the waived proposal by sending it as-is
3.Name where the authority to waive a policy lives (you commit to an answer)
4.Mark the customer message as an untrusted source in the evidence compiler
5.Re-run C04 and show the proposal is now clarify with no waiver

You will practise

→Recognise an indirect prompt injection inside evidence rather than in the prompt
→Explain why a model's proposal is not an effect and where write authority lives
→Mark evidence sources as untrusted so instruction-like text is data, not command
→Prove a hardening change by re-running the recorded case that exposed it

The mechanism, explained

Prompt injection
direct and indirect injection, and why filtering text is never the whole defence
The lethal trifecta and hardened tools
the interview question on untrusted content, private data and an outbound action in one system
Course lesson: bind approval to the action
the mechanism that made the service refuse C04: approval is a separate, recorded act
Bounded autonomy and human-in-the-loop
why the proposal reached an operator instead of a warehouse

Mission workspace

This mission opens with a free account. The brief above is the whole problem; the box, the hints and the debrief are behind sign-in.

a free account unlocks the core curriculum tier · no card

← all missions next: Approval bound to the wrong revision →