Prompt injection in tender documents: monitoring with a boundary for hostile content

A tender analyst reads dozens of notices a week. Automating that process looks obvious until you realize what you are letting into the system: documents written by third parties nobody at your company controls.

Prompt injection has topped the OWASP Top 10 for LLM applications for years. The mechanism is simple: content the system was meant to read as data gets interpreted as an instruction. In tender monitoring this is no theoretical scenario. A notice field or an attachment can carry text that tries to persuade the model to move raw content onward, into the part of the system that has tools.

Model instructions are not an access boundary

A common response is to tell the model to ignore instructions found in documents. This may help, but safety still depends on the model obeying the instruction.

We built our tender monitoring so that the component reading the document has no tools or credentials. Even a successfully injected instruction therefore has nothing to act with.

Separate the document reader from the decision process

The system splits into two parts with separated privileges.

The reader sees the document's content but runs in isolation, with no network access, database access, storage credentials, or decision tools. Configuration and audit records make this boundary checkable.

The decision process runs the four assessment steps but never sees raw content. It receives only named fields in a fixed data format that has no place for the source text. An instruction hidden in the document therefore cannot pass into the component with tools.

Between them stands the third element: quarantine. Security rules classify artifacts, and a document bearing an injection signature stops in a separate lane, with an audit entry and a visible justification. The analyst sees the hold and its reason before the document can become an incident.

What the measurement showed

The control set contained 14 texts: 6 with a hidden instruction and 8 clean. Detection found every prepared injection and raised no false alarm. Both attempts to push raw fields into the decision process were rejected by the data contract. All 670 register values passed through unchanged, and the local 95th-percentile time was 122.23 ms. A separate small-model tender read using gpt-5-mini took 1.99 seconds and cost about PLN 0.00083.

These controlled texts are not tender specifications, and the set contains no SWZ files. The result verifies the current rules and the reader-planner contract. Detection quality against the variety of real procurement documents still needs an expert-labeled client set. The privilege boundary remains useful even when a new attack slips past the filter, because raw content cannot reach the planner.

Why privilege separation matters

A content filter reduces the chance that a known pattern passes. Privilege separation limits what can happen even when detection fails. The system uses both layers, and its configuration and data contract still require testing.

A threat model for every outside document

Follow one artifact through the system and name the possible consequence at every transition.

The decisive question is what the reader can do when the filter misses a new attack pattern. If it has credentials, network access, and tools, safety still depends on detection. Restricting its privileges reduces the possible impact of content the filter has never seen.

The operational cost of quarantine

Quarantine creates a manual review lane. An aggressive filter may hold legitimate specifications containing language that resembles a technical instruction. A permissive filter leaves more work to the isolation boundary.

A pilot should therefore measure prepared-attack detection, clean-document false holds, and time spent reviewing quarantine. The workflow can still save time when the analyst receives a short, explained exception instead of rereading the full artifact, but that review effort belongs in the operating-cost model.

Acceptance checklist for tender monitoring

Before connecting live sources, verify:

1. The reader has no keys, network access, or storage credentials.
2. The schema rejects extra fields, long free text, and unknown types.
3. The decision process can operate without raw document content.
4. Every extracted value links to the official record and file version.
5. Quarantine shows a reason and has a named review owner.
6. Parser failure, resource-limit exhaustion, and unknown formats end in a safe hold.
7. Reader or schema changes rerun privilege and raw-content transfer tests.

A useful evaluation includes controlled attacks and difficult legitimate documents from the relevant industry. The recorded demonstration establishes behavior on its prepared set. A production decision needs files that represent the team's actual sources, formats, and language.

If your team reads dozens of notices a week and distrusts automation because of hostile documents, see the case page or book a free process scan: we will show the controlled run and its quarantine boundary in action.