Map every untrusted content channel before you launch an LLM feature

Before launch, list every route by which text reaches the model, mark each as trusted or untrusted, and write down what the model is allowed to do after reading it. OWASP's guidance recommends exactly this first step: identify all untrusted content channels, then enforce permissions in code outside the model.

Step 1: list the channels

Start with the obvious one, the chat box. Then keep going. OWASP's prompt injection material names external content such as websites, files, emails, documents, code comments, commit messages and issues as places injected instructions can sit.

Walk through your feature and ask where text comes from:

• Direct user input.
• Documents or files users upload.
• Web pages the model fetches or summarises.
• Email, tickets, chat messages and comments.
• Retrieved chunks from a knowledge base.
• Tool and API responses.
• Stored memory from earlier sessions.
• Images and other media with embedded text.

Include internal sources. A support ticket written by a customer is untrusted even though it lives in your own system.

Step 2: mark the trust level

For each channel, decide who can write to it. If someone outside your control can, the channel is untrusted. If only a tightly managed process can, it is closer to trusted. Be honest about edit rights. A shared wiki that any employee can edit is not the same as a reviewed repository.

Step 3: attach consequences

This is the useful part. For each untrusted channel, write what the model may do after reading it. A table works:

• Public web page: untrusted? Yes; tools the model may use afterwards None, summarise only
• Customer ticket: untrusted? Yes; tools the model may use afterwards Read ticket history, no sending
• Internal reviewed runbook: untrusted? Mostly no; tools the model may use afterwards Read only

If a channel can feed a model that also has a send, delete or pay capability, you have an indirect injection path. OWASP's excessive agency scenario is the standard example: a mail reading assistant with a plugin that can also send mail, steered by a malicious email. The suggested fix was a read only scope and manual approval for sending.

Step 4: enforce, then test

Implement the limits in code, not in the prompt. Then test each channel with a harmless canary instruction and see whether the model acts on it. OWASP suggests treating the model as an untrusted user while you validate trust boundaries and access controls.

Revisit the map whenever you add a tool, a data source or an integration. Most new risk arrives that way.

Safeguard's asset discovery and agent identity capabilities can help you see which agents and tools exist, which is a prerequisite for a complete map.

Quick check

Sources

• OWASP LLM Prompt Injection Prevention Cheat Sheet
• OWASP GenAI: LLM06 Excessive Agency
• OWASP GenAI: LLM01 Prompt Injection

Last reviewed: 19 October 2026.