AI › Module 2 › Lesson 3
Trust Boundaries
Trust boundaries literacy separates trusted system instructions from untrusted user and retrieved content — draw boundaries on YOUR $AI_LAB toy.
Visual · t32_trust_boundaries
Trust boundaries literacy. $AI_LAB only. Original Cyberlium.
Opening
Trust zones fail when everything lands in one context bucket — literacy names what the model should never obey from untrusted input.
Trust boundaries define: system/developer instructions (trusted), user messages (untrusted), retrieved documents (untrusted until validated), tool outputs (conditionally trusted). Prompt injection succeeds when untrusted content overrides trusted instructions — defender fix is boundary enforcement, input validation, and output filtering. Cyberlium writes trust boundary card on YOUR $AI_LAB — label trusted vs untrusted zones on toy chatbot diagram. Next: LLM Basics Lab.
1. Trust zones (named)
Trusted: system prompt and developer-set policies. Untrusted: user input, web pages, email bodies, uploaded files, RAG chunks from external sources. Conditional: tool results — trust only after schema validation.
On $AI_LAB, label three zones on toy chatbot diagram with one injection path across boundary.
Command guide
Try these commands — Trust zones (named)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
OWASP LLM Top 10 — https://owasp.org/www-project-top-10-for-large-language-model-applications/ OpenAI safety — https://openai.com/safety NIST AI RMF Govern — https://www.nist.gov/itl/ai-risk-management-framework
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install curl
macOS: Built-in
Windows: Built-in (PowerShell: Invoke-WebRequest)
═══ LINUX / macOS ═══
Command — copy this
export AI_LAB=${AI_LAB:-$HOME/cyberlium-lab/t32-ai}
curl -sS https://owasp.org/www-project-top-10-for-large-language-model-applications/ | head -10
cat > "$AI_LAB/notes/trust-boundaries-checklist.md" <<'EOF'
# Trust Boundaries Checklist (YOUR app design notes)
- [ ] User input treated as untrusted
- [ ] Retrieved docs / web pages treated as untrusted
- [ ] Tool outputs validated before re-prompting model
- [ ] Secrets never in system prompt or user-visible context
- [ ] Model output sanitized before rendering or executing
Review in YOUR lab designs — no unauthorized API probing
EOFCommand — copy this
grep '\[ \]' "$AI_LAB/notes/trust-boundaries-checklist.md"
Primary tools to practice this lesson: grep, curl. Reference sites: OWASP LLM Top 10 (https://owasp.org/www-project-top-10-for-large-language-model-applications/); OpenAI safety (https://openai.com/safety); NIST AI RMF Govern (https://www.nist.gov/itl/ai-risk-management-framework). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. Why boundaries beat 'just tell the model to behave'
Models follow patterns in context — untrusted 'ignore previous instructions' can override weak system prompts. Defenders enforce boundaries with allowlists, structured output, and human review for high-risk actions.
Students practice boundary labeling on lab toys — never test injection on stranger production apps.
3. Ethics: boundaries on your toys only
Forbidden: probing stranger chatbots to map their trust failures. Allowed: trust boundary card — zone map and one defender control for $AI_LAB fictional bot.
Ship: trust boundary card for YOUR sandbox toy. Next: LLM Basics Lab.
4. What you ship: trust boundary card for $AI_LAB
Zone map with trusted/untrusted labels and one control. $AI_LAB named. NO stranger apps. chmod 600.
5. What you record before the next lesson
Date. Trust boundary card. $AI_LAB named. File t32-m02-l03-trust-boundaries.txt chmod 600.
6. Wrong vs right: stranger SaaS vs YOUR toy LLM
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Treat all context as equally trusted. Test boundaries on stranger production chatbot.
Right
Write trust boundary card for YOUR $AI_LAB toy. Next: LLM Basics Lab.
Mission: map trust zones on YOUR lab toy
1) Label trusted, untrusted, conditional zones. 2) Draw one injection path across boundary. 3) Name one defender control (validation, allowlist, review). 4) chmod 600.
Stuck? Ask Cyberlium AI Mentor
If you cannot name untrusted sources, your RAG pipeline has a blind spot.
Knowledge Check
APPLY: User input in LLM context is typically:
Multiple choice
Knowledge Check
APPLY: True or False: Retrieved RAG documents should be treated as untrusted until validated.
True or False
Knowledge Check
APPLY: Trust boundary literacy on Cyberlium avoids:
Multiple choice