An insertion point is any place in an LLM pipeline where sensitive data can enter the working context. Common insertion points are user prompts, retrieved documents, tool results, and generated output. Security teams use this model to decide where to inspect, redact, block, or audit.
Expanded Definition
An insertion point is a trust boundary inside an LLM workflow, not just a technical input field. It marks any stage where data can be introduced into the model’s working context, including direct prompts, retrieval results, tool outputs, system messages, and downstream generated content that may later be reused. In practice, the concept helps security teams decide where inspection, minimisation, filtering, and logging should occur before information becomes part of model behaviour. The idea is especially important in agentic AI and RAG pipelines, where a single workflow may combine human input, external data, and machine-generated artefacts in quick succession.
Definitions vary across vendors because some treat insertion points narrowly as user-facing prompt fields, while others extend the term to every context ingress and egress point in the orchestration chain. NIST AI risk guidance is useful here because it treats AI systems as socio-technical systems that require governance across the full lifecycle, not only at the prompt layer, and the NIST Cybersecurity Framework 2.0 reinforces the need to manage exposure wherever data enters an operational system. The most common misapplication is assuming the prompt is the only insertion point, which occurs when retrieved content, tool responses, and reused outputs are left unreviewed.
Examples and Use Cases
Implementing insertion-point controls rigorously often introduces latency and workflow friction, requiring organisations to weigh stronger governance against faster model interaction.
- User prompts are scanned for secrets, personal data, or malicious instructions before being passed into the model, especially in customer support or internal copilots.
- Retrieved documents from a knowledge base are checked for poisoning, privilege leakage, or stale content before being injected into a RAG context.
- Tool results from ticketing systems, code repositories, or cloud APIs are sanitised before the agent can act on them or quote them back to the user.
- Generated output is reviewed when it is later recycled into another prompt, because model output can become a new insertion point in multi-step workflows.
- Security teams align these checks with data handling and monitoring practices described in the NIST Cybersecurity Framework 2.0 and related AI governance guidance.
Why It Matters for Security Teams
Insertion points matter because they are where prompt injection, data leakage, and privilege escalation often become operational realities. If teams only harden the front door, sensitive content can still enter the model through retrieval plugins, agent tools, or chained outputs, then influence decisions or expose regulated data. For NHI governance, this is especially relevant when service accounts, API tokens, or other machine identities are used to fetch context, because the insertion point becomes both a data control and an identity control. In broader AI security programs, the term helps teams map where content should be redacted, tagged, approved, or blocked before it can shape model behaviour. The concept also supports logging and incident response, since investigators need to know which context source introduced the risky material. Organisations typically encounter the consequences only after an agent has exposed secrets, followed a poisoned instruction, or produced a harmful action, at which point insertion-point analysis becomes operationally unavoidable to address.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10 address the attack and risk surface, while NIST AI RMF and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| NIST AI RMF | AI RMF addresses governance across AI lifecycle touchpoints where data enters model context. | |
| NIST CSF 2.0 | PR.DS | Data security practices apply to sensitive content entering and moving through AI workflows. |
| OWASP Agentic AI Top 10 | Agentic AI guidance covers prompt injection and unsafe context handling at insertion points. |
Map each context ingress to governance, measurement, and monitoring duties before deployment.
