# INP-02 Indirect prompt injection defense (Critical)

Domain: INP Input & Prompt Security · HI-AAF v1.3 · Public review · https://humanintel.net/standard/inp/inp-02

Indirect prompt injection defense is applied to content returned from tools, retrieval systems, web pages, emails, documents, and agent memory. Such content is treated as untrusted data and is not executed as instruction without explicit user confirmation.

Indirect injection, where malicious instructions are placed in documents, web pages, emails, or other content the agent retrieves, is the most under-defended attack class in production today. INP-02 requires that retrieved content be processed in a trust boundary that prevents it from issuing commands to the agent. Detection rates and false-positive rates are measured.

Critical control: a Critical failure precludes HI-AAF Certification regardless of the maturity level achieved on any other control.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for INP-02: All retrieval paths apply trust boundary tagging; sampling-based human review of flagged retrievals is in place; injection-attempt rate is reported quarterly with trend analysis.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- All retrieval paths apply trust boundary tagging.
- Sampling-based human review of flagged retrievals is in place.
- Injection-attempt rate is reported quarterly with trend analysis.

## Framework mappings

- NIST AI RMF: MEASURE 2.7, MEASURE 2.8
- ISO/IEC 42001: A.8.2
- OWASP LLM Top 10: LLM01
- SOC 2 (TSC): CC7.1, CC7.2
- EU AI Act: Art. 15(4)
- MITRE ATLAS: Initial Access
- Singapore: MAIGF Security, AI Verify Security, AI Verify Robustness

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cited by INP-08 Untrusted content source handling: https://humanintel.net/standard/inp/inp-08
- Cited by INP-09 Memory and retrieval injection defense: https://humanintel.net/standard/inp/inp-09
- Cited by MAS-09 External agent trust boundaries: https://humanintel.net/standard/mas/mas-09

## Cite this control

Human Intelligence. HI-AAF v1.3, INP-02 Indirect prompt injection defense. Public review edition, July 2026. https://humanintel.net/standard/inp/inp-02