An analyst observes an AI application retrieve or ingest lower-trust content containing instructions that attempt to redirect the application's behavior. Within the same agent execution context, the AI system subsequently attempts a tool invocation, resource access, or workflow transition outside the actions authorized for the original task or retrieved resource. The analyst correlates content provenance, instruction evidence, subsequent operation, and authorization context to identify potential promotion of untrusted content into operational authority.
| Data Component | Name | Channel |
|---|---|---|
| Application Log Content (DC0038) | AWS:bedrock | AgentTrace.knowledgeBaseLookupInput |
| AWS:bedrock | AgentTrace.actionGroupInvocationInput |
| Field | Description |
|---|---|
| TrustedInstructionSources | Sources authorized to provide operational instructions to the AI application |
| UntrustedContentSources | Retrieved resources and tool responses that must remain task data rather than operational authority |
| AuthorizedAIWorkflows | Permitted task sequences and workflow transitions |
| AICapabilityScopes | Authorized tools, resources, and operations for each agent or application role |
| ApprovedContentDrivenActions | Actions retrieved content may legitimately influence |
| RetrievalToActionWindow | Maximum interval between content ingestion and subsequent operation |
| RequiredRetrievalCorrelation | Required session, trace, resource, or invocation identifiers linking the event sequence |
| MinimumInstructionEvidence | Evidence required to distinguish an instruction attempt from ordinary retrieved data |
| AuthorizedAdversarialTesting | Approved testing contexts and exceptions |