const {P,H2,H3,Callout,Code,Ul,Related,PostHead}=window;
function Article(){
return <>
<PostHead cat="/CASE" date="2026-07-17" title="Case: the wiki page that was an instruction" lede="Internal knowledge bot. Authorized. A retrieved page overwrote the preset because retrieval and policy shared a privilege level. Composite, desensitized."/>
<P>The product was a “ask the wiki” bot. System prompt said stay in corpus, cite pages, do not invent. Users liked it. Security asked us to try to make it forget the corpus. We did not need a clever string. The index already contained one.</P>
<Callout>Composite of internal RAG reviews. No customer wiki titles. The failure mode is the point.</Callout>
<H2>What we found</H2>
<P>A page in the engineering wiki, written years ago, titled in the spirit of “how the assistant should behave.” It was documentation for humans. The embedder did not know that. Top-k for a meta question retrieved it. The generator treated it as equal to the system prompt because both arrived in the same concatenated user blob.</P>
<P>The bot then answered out-of-corpus questions in the tone of that page. Grounding was optional in the template — “cite if you can.” So it did not fail closed. It just stopped citing.</P>
<H2>What we changed</H2>
<Ul items={[
'Policy in the system channel only. Chunks labeled data, never instruction.',
'No citation, no claim. Empty hits → refuse.',
'Ingest scan: instruction-shaped headings get a tag the generator is told to treat as untrusted even among chunks.',
'The old wiki page stayed for humans. It dropped out of the bot index.'
]}/>
<P>The four gates on tools were already decent. RAG was the hole. Tools and retrieval are different surfaces. Both have to be untrusted. Write-up of the pattern: <a href="post-rag.html">RAG context is untrusted</a>.</P>
<H2>What we did not do</H2>
<P>We did not dump the corpus to a laptop. We did not publish the override page. We did not claim a CVE on a wiki. The customer got a harness change and an ingest rule. That is the whole case.</P>
<Related items={[
['post-rag.html','RAG context is untrusted'],
['post-four-gates.html','Four gates'],
['post-loops.html','From prompts to loops']
]}/>
</>;
}
window.Article=Article;
mountPost();