# INP-08 Untrusted content source handling

Domain: INP Input & Prompt Security · HI-AAF v1.3 · Public review · https://humanintel.net/standard/inp/inp-08

Untrusted content sources (emails, attachments, retrieved documents, web pages, embedded media) are handled as data; embedded instructions are not honored without verification.

Content from untrusted sources, emails, attachments, retrieved documents, web pages, embedded media, is treated as data, not as instruction. Any instructions embedded in such content are not honored without explicit verification through the trust boundary defined in INP-03. This control is the operational complement to INP-02's indirect injection defense.

## Maturity

- L1 Ad hoc: Controls exist informally; documentation is incomplete; no consistent review.
- L2 Documented: Controls are written down; ownership is assigned; review cadence is defined.
- L3 Operated: Controls are followed in practice; evidence is collected; deviations are tracked. Published criterion for INP-08: All untrusted content sources are identified and documented; handling rules treat embedded instructions as data; the control is tested as part of adversarial assessment; no embedded instruction from an untrusted source has been executed without verification.
- L4 Measured: Control effectiveness is measured against documented thresholds; trends are reported.
- L5 Continuously Improved: Controls evolve based on incident learning; maturity gains are evidenced over time.

## Evidence an assessor asks for

- All untrusted content sources are identified and documented.
- Handling rules treat embedded instructions as data.
- The control is tested as part of adversarial assessment.
- No embedded instruction from an untrusted source has been executed without verification.

## Framework mappings

- OWASP LLM Top 10: LLM01, LLM05
- EU AI Act: Art. 15(4)
- MITRE ATLAS: Initial Access
- Singapore: MAIGF Security, AI Verify Security, AI Verify Robustness

Mappings are directional: meeting this control evidences but does not by itself satisfy the external requirement.

## Related

- Cites INP-02 Indirect prompt injection defense: https://humanintel.net/standard/inp/inp-02
- Cites INP-03 Trust boundary enforcement: https://humanintel.net/standard/inp/inp-03
- Glossary: Trust boundary: https://humanintel.net/standard/glossary#trust-boundary

## Cite this control

Human Intelligence. HI-AAF v1.3, INP-08 Untrusted content source handling. Public review edition, July 2026. https://humanintel.net/standard/inp/inp-08