AI-Assisted Secure Coding (Appendix C) · Secure Prompt & Context Management
System instructions beat repository content
Verify that the AI tool enforces an instruction hierarchy, with system and developer messages taking precedence over untrusted repository content. This hierarchy has to hold across multi-turn conversations and tool-augmented workflows.
OWASP AISVS v1.01, requirement AC.3.4
In plain English
The AI tool must put your system and developer instructions ahead of anything it reads in a repository, through long conversations and through tool use. Otherwise a file, comment or web page can take over the assistant.
What good looks like
- Your instructions sit in the system or developer role.
- Repository content, tool output and web content are marked as data.
- Tests try to override instructions from repository files, over many turns and through tool results.
- Instruction files in the repository are reviewed like code.
How teams usually do it
- Prompt templates that separate instructions from repository content, tested against each model version.
- Protecting agent instruction files (for example AGENTS.md, CLAUDE.md or rules files) with code owners, since tools load them as trusted instructions.
- Choosing tools that document how they separate instructions from content.
Suggested evidence
- Templates or tool configuration.
- Multi-turn and tool-augmented override test results.
- Branch protection on instruction files.
Common mistakes
- Letting instruction files or README content from an untrusted branch act as trusted instructions.
- Testing single-turn overrides only.
- Loading instruction files from dependencies or vendored directories.
Not sure which requirements apply to your system? Take the assessment, or browse every guide in this chapter.
Requirement text from the OWASP AI Security Verification Standard, licensed under CC BY-SA 4.0. This guidance is shared under the same licence.