Prompt injection exposes a runtime governance gap for enterprise AI

At a glance

What this is: NHI Mgmt Group's analysis, drawing on WitnessAI's blog post: Prompt injection is a runtime governance problem for enterprise AI, with the key finding that untrusted input can steer model behaviour when instructions and data are processed through the same mechanism.

Why it matters: It matters because security teams governing human, NHI, and autonomous AI workflows need controls that limit what models can see, what they can do, and what actions they can trigger.

Context

Prompt injection is the failure of an AI system to keep trusted instructions separate from untrusted content. In enterprise AI, that matters because the model may treat email text, documents, web pages, or user input as if they were operational commands.

For identity and access teams, the issue is not just content safety. It is runtime governance over AI systems that can expose sensitive data, trigger actions, and act across chatbots, copilots, and agents. Once those systems consume external material, the security boundary shifts from the prompt interface to the controls around access, inspection, and execution.

The article frames the problem as a production issue, not a theoretical one. That is the right frame: if an AI system can be steered by manipulated input, then governance has to follow the runtime path of the interaction, not stop at model deployment.

Key questions

Q: What breaks when indirect prompt injection is not controlled in AI systems?

A: Indirect prompt injection breaks the assumption that retrieved content is safe to use as instruction material. Once malicious text enters the model context, the system may alter responses, leak data, or trigger tools with delegated permissions. The core failure is boundary collapse between data and directive, which turns ordinary content ingestion into an execution risk.

Q: Why do prompt injection attacks create governance risk for AI agents?

A: Prompt injection creates governance risk because the model often sits in the control path between text input and tool execution. If attackers can change what the model treats as authoritative, they can influence access decisions, data exposure, or downstream actions without compromising a traditional account. That makes prompt provenance and instruction hierarchy part of AI identity governance.

Q: How do teams know whether AI prompt controls are actually working?

A: Look for whether the control is operating at the moment of prompt entry and whether it can distinguish data classes, account type, and destination. If users can still paste regulated content into personal AI sessions without warning or enforcement, the control is cosmetic rather than operational. Effective controls reduce silent leakage, not just alert volume.

Q: What is the difference between prompt filtering and runtime AI governance?

A: Prompt filtering focuses on the text that enters a model, while runtime AI governance covers the full decision path, including access scope, tool use, output handling, approvals, and audit trails. Filtering is one layer. Governance is the architecture that determines whether a manipulated model can actually do damage.

Technical breakdown

Why LLMs blur the line between instruction and data

Large language models do not inherently distinguish between a trusted system instruction and untrusted content embedded in email, documents, web pages, or retrieved context. That design property is what makes prompt injection possible. Direct injection attempts override instructions outright, while indirect injection hides malicious instructions inside content the model later consumes. The model can then surface secrets, change behaviour, or produce actions the operator never intended. The important technical point is that the trust boundary sits outside the model, not inside it.

Practical implication: enforce controls around what content reaches the model, not just around the model prompt itself.

Why agentic AI makes prompt injection more dangerous

When a model is connected to tools, databases, or external actions, prompt injection stops being a content problem and becomes an execution problem. The attack surface expands because manipulated input can influence tool selection, action timing, and downstream side effects. In agentic workflows, the danger is not merely wrong answers but unauthorized actions taken under the model’s apparent authority. That is why the article links prompt injection to least privilege, approval gates, and scoped credentials: the injected instruction can only do as much damage as the agent is allowed to do.

Practical implication: treat tool access, action scope, and approval thresholds as first-class security controls for AI agents.

How layered runtime controls contain prompt injection

The article’s mitigation model is defense in depth: intent-aware inspection, bidirectional input and output filtering, tokenization, scoped access, human approval for high-consequence actions, contextual separation, and continuous monitoring. Each layer addresses a different failure mode. Input controls block malicious content at the boundary, output controls catch harmful responses, and access controls constrain what a compromised model can reach. The runtime layer matters because prompt injection is contextual and adaptive, which makes static blocklists insufficient on their own.

Practical implication: design AI controls as a layered runtime stack with independent enforcement points, not a single content filter.

Threat narrative

Attacker objective: The attacker wants the AI system to treat untrusted content as trusted instruction so it reveals data or performs actions on the attacker’s behalf.

1. Entry occurs when malicious instructions are embedded in direct prompts or in indirect content such as emails, documents, or web pages that an AI system retrieves and processes.
2. Credential or context abuse follows when the model accepts the untrusted content as operational guidance and uses it to shape responses, disclose sensitive material, or select tools.
3. Escalation happens when the manipulated model is connected to external actions, allowing the injected instruction to influence transactions, code execution, or data access beyond its intended scope.
4. Impact is the exfiltration of sensitive data, unauthorized actions, or harmful outputs that create operational, legal, and governance exposure for the enterprise.

Breaches seen in the wild

• ForcedLeak (Salesforce Agentforce) 2025: A critical Agentforce flaw let attackers steer an AI agent through a Web-to-Lead form to leak CRM data via an expired allowlisted domain.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Runtime governance is the real control plane for enterprise AI. Prompt injection is not just a model safety issue because the model is operating inside a broader execution environment. Once copilots and agents can retrieve data, call tools, and trigger actions, the control problem shifts to what is allowed to enter the context window and what the system can do with it. Practitioners should treat AI runtime policy as part of identity and access governance, not as an adjacent content review function.

The security assumption that instructions and data are separable collapses in LLM-based systems. That assumption was designed for systems where commands and content sit in different layers. It fails when the actor processes both through the same mechanism and can be influenced by retrieved text, emails, or documents. The implication is that deterministic trust boundaries must be rebuilt outside the model, because the model itself cannot enforce them reliably.

Least privilege for AI needs to be measured by action scope, not model capability. An AI system can be technically powerful while still being governance-light if it cannot reach sensitive tools or high-consequence workflows. The same principle that limits NHI blast radius now applies to AI assistants and agents. Practitioners should re-evaluate whether their AI permissions are tied to task need or to broad platform convenience.

Prompt injection is an auditability problem before it is an adversarial AI problem. If security teams cannot show what the model saw, what policy fired, and what action was blocked, they cannot prove control effectiveness after an incident. That makes visibility, logging, and approval evidence part of the control architecture. The field needs runtime governance that can survive scrutiny from both security operations and compliance teams.

Intent-aware inspection is the named concept this category needed. Static keyword filtering cannot keep up with synonym swaps, multilingual payloads, role-play framing, and hidden instructions in retrieved content. Intent-aware inspection changes the question from 'does this string look bad' to 'what is this interaction trying to make the system do'. Practitioners should use that shift to redesign policy enforcement around meaning, not pattern matching.

What this signals

Prompt injection forces AI governance to move from model-centred safety checks to runtime control design. Security teams should assume that untrusted content can reach the model through email, documents, web pages, and retrieval pipelines, so controls need to sit at the boundaries where content becomes action.

Access scoping is now an AI risk control, not only an identity control. If a copilot or agent can reach broad tools, write paths, or external systems, a successful injection inherits that authority. The practical question is no longer whether the model can be tricked, but how far the trick can travel.

Audit evidence will decide whether AI security programmes are credible. Organisations need to show what the system saw, what policy intervened, and whether a human was required before a high-consequence action completed. Without that trail, runtime governance remains an assertion rather than a control.

For practitioners

• Enforce scoped AI access Limit every chatbot, copilot, and agent to the minimum data sources, tools, and write permissions required for its task. Use task-specific credentials, read-only defaults where possible, and periodic access reviews so prototype permissions do not persist into production.
• Deploy intent-aware inspection Inspect prompts and retrieved content for malicious intent rather than relying on keyword blocklists alone. Build policies that can distinguish ordinary research requests from attempts to extract secrets or trigger unsafe actions.
• Separate input and output controls Filter content before it reaches the model and again before model responses reach users or downstream tools. Keep these controls independent so one missed layer does not become a total failure path.
• Gate high-consequence actions with human approval Require explicit human review for transactions, external communications, code execution, and production changes. Enforce the approval gate in the application layer so the model cannot waive review by claiming the action is safe.
• Tokenize sensitive data before model exposure Replace PII, credentials, and proprietary information with reversible tokens before any external model sees it. That reduces the exfiltration value of a successful injection and lowers the blast radius of context compromise.

Key takeaways

• Prompt injection is a runtime governance failure because enterprise AI systems can act on untrusted content as if it were trusted instruction.
• The risk extends beyond chatbots to copilots and agents that can retrieve data, call tools, and execute actions with inherited permissions.
• Effective control depends on layered inspection, scoped access, human approval for high-impact actions, and auditable evidence of enforcement.

Key terms

• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Runtime Governance: Runtime governance is the set of controls that verify what a system or agent is actually doing after deployment. It combines monitoring, authorization checks, and access validation so teams can detect drift, misuse, or excessive privilege in motion rather than assuming build-time policy still holds.
• Intent-Aware Inspection: Intent-aware inspection is a control approach that evaluates what an AI interaction is trying to achieve, rather than matching keywords alone. It is especially useful for prompt injection because attackers can hide malicious intent behind paraphrases, encodings, multilingual text, or legitimate-looking requests.
• Bidirectional Filtering: Inspection of both prompts going into an AI system and responses coming out of it. This approach reduces jailbreak risk by normalising input, blocking malicious instructions, and preventing sensitive data from leaving the system through unsafe output or downstream tool calls.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an identity security programme, it is worth exploring.