AI Control Library / CF-11: Objective & Policy Constraints
Designation: Core | Control types represented: Operational and Technical
Control requirement
Protect system prompt configuration from unauthorized modification and isolate trusted instructions from untrusted content in the application’s construction and control paths. Keep secrets and critical authorization outside the prompt.
Why this matters
Prompt wording can influence behavior but cannot guarantee confidentiality or enforce permissions. Protecting configuration and separating content reduces exposure while independent system controls preserve the actual security boundary.
How the control types work together
Operational controls define scope, authority and the actions required when conditions are not met. Technical controls produce evidence or enforce the relevant boundaries. Both must apply to the same deployment and operating conditions.
When it applies
AI system and developer instructions, prompt templates and retrieval or tool content combined during request construction.
Define the assessed boundary, dependencies and evidence limitations. Tailor depth and review frequency to potential impact, and document why a particular safeguard or exclusion is appropriate to the actual deployment.
Ownership
The application owner manages configuration; security and engineering enforce access, versioning and external authorization.
Implementation guidance
- Store trusted prompt templates in controlled configuration with attributable review and deployment references.
- Separate trusted instructions from user, retrieved and tool content using supported message roles and safe construction, without treating that separation as complete injection prevention.
- Remove credentials and unnecessary sensitive configuration from prompt content, enforcing permissions in independent services.
- Test unauthorized template edits, content confusion and disclosure attempts, evaluating real data or action effects rather than prompt secrecy alone.
How to verify it
Use representative records and authorized controlled tests. Identify the relevant version, operating conditions and expected result before testing, and retain enough evidence to support the conclusion.
| Test | Expected result |
|---|---|
| Attempt an unauthorized template change | Configuration controls prevent or detect it. |
| Provide content pretending to be system instructions | Action and data authorization remain independently enforced. |
| Inspect prompt contents | They do not contain reusable secrets required only by external services. |
Record a finding when required results cannot be demonstrated or practice differs materially from the approved conditions. Missing evidence limits the conclusion; it should not be treated as a successful test.
Evidence to retain
- Prompt configuration and access
- Version and deployment records
- Secret and construction review
- Boundary and adverse-case tests
Protect evidence according to its sensitivity, access needs and retention rules. Avoid unnecessary copies of personal information, secrets or confidential material, while preserving the records needed for authorized review.
If the control fails
Escalate unauthorized prompt changes or exposed secrets to security and the application owner. Contain actual authority exposure and replace compromised secrets where needed.
Example in practice
Hypothetical example: A user elicits a policy summary from an assistant. No credentials are present, and external authorization still blocks privileged actions; assessment focuses on those real boundaries rather than assuming the prompt is an inviolable secret.
Related controls
- CF08-S07: AI Application Source Code Management
- CF12-010: Prompt Injection Defense
- CF12-002: AI System Least Privilege Access Control
Framework mappings
- CSA AICM (AIS-15)
- NIST AI RMF (MEASURE 2.5)
- MITRE ATLAS
- OWASP LLM Top 10
Review and maintenance
Review at the interval approved by the control owner and after relevant changes, incidents or failed assessments. Update affected procedures and configuration, address evidence gaps and verify corrective action before closing findings.
Back to Objective & Policy Constraints
Version 1.0