> ## Documentation Index
> Fetch the complete documentation index at: https://anthale.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Map Prompt Injection Attack Surfaces and Boundaries

> Find the trust boundaries where Anthale should evaluate prompt injection risk across user input, retrieval, tools, files, and model output.

Map every place untrusted text can change model behavior. This page helps you decide where prompt injection checks should run in a real system.

<Steps>
  <Step title="Inventory every untrusted input">
    Start with a concrete list of the places your application accepts or generates text. Include direct user
    messages, uploaded files, OCR output, retrieved documents, search results, connector responses, tool results,
    and saved conversation state. If it can eventually be merged into model context, it belongs in the inventory.
  </Step>

  <Step title="Mark what reaches model context">
    For each item in the inventory, answer one question: does this text reach the model as prompt content, retrieved
    context, tool context, or conversation history. If the answer is yes, it is part of the prompt-injection surface even
    if the original source was not a chat box.
  </Step>

  <Step title="Separate the boundaries you actually control">
    Most teams think only about user input. In practice, there are at least four boundaries worth checking: the inbound
    request before the model call, the context-ingestion step before retrieved or third-party text is merged, the
    execution boundary before model-generated tool actions are trusted, and the output boundary before model output
    reaches a user or another system.
  </Step>

  <Step title="Put Anthale before the boundary, not after it">
    Run Anthale before untrusted material crosses into the next stage. That means before prompt assembly, before retrieved
    context is appended, before high-risk tool output is trusted, and before sensitive output is delivered. If you wait
    until after the model has already consumed malicious context, you are no longer preventing prompt injection. You are
    only observing the aftermath.
  </Step>

  <Step title="Review the surfaces people forget">
    The surfaces teams miss most often are long conversation history, retrieved snippets from trusted-looking
    sources, tool results that are fed back into the model, and text extracted from files or images. Those paths
    often feel indirect, but they are exactly where prompt injection becomes hard to notice.
  </Step>
</Steps>

## Result

At the end of this exercise, you should have a boundary map that tells you where Anthale runs on the `input` path, where your application still needs business authorization, and which indirect sources deserve the same level of scrutiny as direct user input.

## Next steps

From here, return to [Prompt Injection Protection](/docs/learn/guardrails/prompt-injection) or move to [Data Leakage Prevention](/docs/learn/guardrails/data-leakage).