# INP-03 Trust boundary enforcement

Domain: INP Input & Prompt Security · HI-AAF v1.3 · Public review · https://humanintel.net/standard/inp/inp-03

A trust boundary is enforced: instructions originating from non-user sources require user confirmation through the primary interaction channel before any consequential action. In multi-agent chains, confirmation binding is governed by MAS-03.

The boundary between user-provided content and system-issued instructions is enforced at every layer. Instructions originating from non-user sources, tools, retrieved documents, other agents, cannot direct consequential actions without explicit user confirmation through the primary interaction channel. In multi-agent chains, confirmation binding is governed by MAS-03.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for INP-03: Trust boundaries are documented for all input paths; enforcement is tested as part of the adversarial assessment; no consequential action from an untrusted source has bypassed confirmation in the review period.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- Trust boundaries are documented for all input paths.
- Enforcement is tested as part of the adversarial assessment.
- No consequential action from an untrusted source has bypassed confirmation in the review period.

## Framework mappings

- NIST AI RMF: MEASURE 2.8
- ISO/IEC 42001: A.8.2
- OWASP LLM Top 10: LLM01, LLM05
- SOC 2 (TSC): CC7.1
- EU AI Act: Art. 15(4)
- MITRE ATLAS: Initial Access
- Singapore: MAIGF Security, AI Verify Security

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites MAS-03 Confirmation binding across chains: https://humanintel.net/standard/mas/mas-03
- Cited by INP-08 Untrusted content source handling: https://humanintel.net/standard/inp/inp-08
- Cited by INP-09 Memory and retrieval injection defense: https://humanintel.net/standard/inp/inp-09
- Cited by MAS-03 Confirmation binding across chains: https://humanintel.net/standard/mas/mas-03
- Glossary: Trust boundary: https://humanintel.net/standard/glossary#trust-boundary

## Cite this control

Human Intelligence. HI-AAF v1.3, INP-03 Trust boundary enforcement. Public review edition, July 2026. https://humanintel.net/standard/inp/inp-03