Prompt Injection Is a Permissions Problem, Not a Model Problem

Prompt injection attacks occur when malicious instructions hidden inside documents — such as PDFs — manipulate an AI assistant into executing unintended actions, like leaking private files. The attack works because language models process user instructions and document content as a single stream of tokens, making it structurally difficult to distinguish intent from data. Common defences like system prompts and refusal training raise the cost of attacks but cannot eliminate the risk, since they operate within the same text-based substrate as the attack itself. The author argues that true security requires placing access controls outside the model entirely — in a permission table that no document content can modify or influence. This approach ensures that blocked files remain invisible to the model, that access decisions are looked up rather than reasoned about, and that every failed injection attempt is logged for review.