Control Packs · AI-004 · v1.0.0
Grounded Model Output and Instruction Separation
Decide what a model's output is allowed to be used for before it is used, keep retrieved or user-supplied content separated from the instructions that carry authority, and make a low-confidence or unavailable answer a defined outcome rather than a silent one.
Status: review · Review: not independent. This is design guidance; review status does not establish independent verification or compliance.
What this safeguard addresses
Ensure model output has a stated permitted use and a defined behaviour when it is uncertain or unavailable, and that retrieved or user-supplied content is kept separate from the instructions that grant the component its authority.
- A fluent answer is used as if it were established factA model's output is consumed by a downstream step, shown to a person as an answer, or stored as a record without a stated basis, a confidence expectation, or a defined behaviour when the model is uncertain or unavailable. Content the model retrieved is also carried in the same channel as its instructions, so retrieved text can redirect what it does.
Versioned applicability rule
{
"characteristic": "AI_CONTROLLED",
"equals": true
}Decisions for the project owner
Leave a decision open when its value is unknown. Suggested values become confirmed only through an explicit user decision.
- What should happen when the model is uncertain, unavailable, or returns something unusable?A model that cannot answer well must have a defined outcome. Without one, an empty, malformed, or invented answer flows onward as if it were correct.AI-004-Q1 · choice
Requirements for the coding agent
- AI-004-R1State what model output may be used for, keep retrieved and user-supplied content in a separate channel from the instructions that carry authority, and implement the confirmed behaviour for uncertain, unavailable, or unusable output rather than passing it downstream.
Tests and evidence to retain
- MODEL_GROUNDING_TESTExercise uncertain, empty, malformed, and provider-unavailable responses, and confirm the confirmed fallback behaviour rather than downstream use.
- configuration_or_policy
- implementation_location
- test_result
- telemetry_definition
Passing a published example shows that example's behavior. A coding agent's implementation report remains a claim until its evidence is independently checked.
Related guidance
- SI-10 · Information Input ValidationNIST_SP_800_53_5_2_0 · partially addressesTreating model output as data to be checked before use applies input-validation thinking at an internal boundary; it does not cover the full control family.
- SI-17 · Fail-Safe ProceduresNIST_SP_800_53_5_2_0 · partially addressesA confirmed behaviour for uncertain or unavailable model output is a fail-safe path for this component; it does not establish fail-safe coverage system-wide.
- AU-2 · Event LoggingNIST_SP_800_53_5_2_0 · informsRecording model version and permitted use supports later reconstruction of how an answer was used; it is not a complete audit programme.
Mappings indicate contextual relevance or partial support. They do not establish equivalence, certification, government endorsement, or complete framework implementation.
- National Institute of Standards and Technology — Artificial Intelligence Risk Management FrameworkGUIDANCE_NIST_AI_RMF_1_0
- OWASP Cheat Sheet Series — LLM Prompt Injection Prevention Cheat SheetGUIDANCE_AI_CONTENT_BOUNDARY
- National Institute of Standards and Technology — Security and Privacy Controls for Information Systems and OrganizationsGUIDANCE_NIST_SP_800_53_5_2_0