How do you guard against hidden instructions without crippling the AI?

My rule is simple: the AI has to bring everything to the point of a draft, open in a browser tab, and never further on its own. Only a secret codeword that I alone know unlocks the actual send or publish. That second step costs me a few seconds per task. It is the reason I can give an agent access to my inbox and still sleep well. When I tell the AI to send an email, it only opens the email as a draft. Without the codeword, nothing happens even after repeated requests. Only the codeword actually triggers sending, and then everything waiting goes out at once. I showed this live at the KI DeepDive on 3 August. Five completed forms sat ready, each in the internal browser, each in its own tab, each one click away from going out. The machine sent none of them. The reason is prompt-injection. An outside email or document can contain a sentence that reads like an instruction, for example publish this right now under your own name. I built exactly that scenario in the DeepDive to make it concrete: a destructive article, hidden inside a request that looks harmless. A general instruction like handle everything does not trigger sending, even repeated, even from me. Only the codeword unlocks approval, and it never turns up by chance in an incoming message.

Why a codeword defends against hidden instructions

The reason is prompt-injection. An outside email or document can contain a sentence that reads like an instruction, for example publish this right now under your own name. I built exactly that scenario in the DeepDive to make it concrete: a destructive article, hidden inside a request that looks harmless. A general instruction like handle everything does not trigger sending, even repeated, even from me. Only the codeword unlocks approval, and it never turns up by chance in an incoming message.

That word works like a small password against prompt injections.

When the machine meets an instruction that did not come from me, I run three questions. Together they take less than half a minute, and they settle almost every doubtful case.

  • Where does the instruction come from? From my brief, or from a text the AI merely read?
  • What does it ask for? Something prepared, or something that goes outside and cannot be pulled back?
  • Is the codeword there? Without that word it stops at the draft, however urgent the tone.

What an agent may prepare

The line runs between preparing and acting. Everything that can be pulled back, the machine may do alone. Everything that lands outside belongs to me. Every brief I write is cut along that line.

  • Research, read, collect sources, and summarise where things stand.
  • Write drafts, fully formatted, and put each one in its own tab.
  • Fill in forms, up to the final click.
  • Sort files, create folders, file notes, propose dates.
  • Say where it is unsure instead of guessing.
  • Send, to anyone, internal recipients included.
  • Delete, whether emails, files, or calendar entries.
  • Buy or order, whatever the amount.
  • Agree to anything: terms, a cookie banner, or an approval in the name of the company.
  • Change access, meaning granting rights, connecting accounts, or setting up rules in the inbox.

The draft sits visible in a tab

Open in a browser tab is a setting for me, not a figure of speech. I have drafts open in the internal browser of the tool rather than in a separate browser app. Then every draft sits visible in one place. The official documentation on the internal browser describes the same separation. The page on approvals and security goes further and treats page content as untrusted context, especially before sensitive input. Why access rights decide more than the wording of my brief is in Access beats prompt.

In front of the audience I then opened the tabs holding press drafts. Instead of sending them, I reworked one myself and had the rest revised again. A draft I can still touch gets better.

The same boundary applies to a department

An AI department works on exactly this pattern. Every agent prepares its work, whether a newsletter, a social post, or a form, but nothing leaves the building on its own. The rule is called draft before send and sits in every role handbook we write. Before it comes a check on tone and claims, the guardian of the brand. Approval still happens at your end, by a person who has seen the draft. How such a department gets built is on the AI implementation page.

The rule has been written down for a while. My brief for email holds three sentences: send nothing, archive or delete nothing, and the task is finished only once I can click through every draft in the tabs. In the setup checklist for a new agent workstation it became an acceptance criterion. Sending stays human at first, and an unsafe send is never retried automatically.

The codeword has one weakness, and it sits with me. In the DeepDive I said it out loud once, and in the same breath I said I would have to change it. A word that someone else knows protects nothing. A second rule comes out of the same session, in uncomfortable truths.

From the KI DeepDive

KI DeepDive Agenten-Mindset, public live session, 3 August 2026.

  • Fixed rule: the AI only ever brings an email to the draft stage, open in a browser tab
  • A secret codeword unlocks the actual send, a general instruction like handle everything is not enough, not even repeated
  • Five completed forms sat live in the internal browser, each one click away from going out, and open press drafts were revised in front of the audience instead of sent
  • Named explicitly as protection against prompt injection, because the codeword never appears by chance in an outside message

Rule card: draft before send

What an agent may do, what it never does without you, and three checks for hidden instructions. PDF · A4, 1 pages, 40 KB, as of 3 September 2026.

This note keeps growing

2026-09-03: Deepened: the three check questions for hidden instructions, two lists for the line between preparing and acting, the internal browser as a setting, the written rule from prompt pack and setup checklist, list of sources.

2026-09-02: Planted from the KI DeepDive Agenten-Mindset.

ZukunftBilden GmbH · Salzburg · +43 681 81655313 · office@zukunftbilden.eu