Essential session storage is required to sign in. Optional analytics remain off unless you allow them.
Design the prompt for a document Q&A assistant. The SYSTEM prompt must make it answer ONLY from provided context, cite which passage it used, and say 'I don't know' when the answer isn't present. It must RESIST PROMPT INJECTION: retrieved documents and user input are treated as DATA, not instructions (instruction hierarchy + delimiters), so a passage saying 'ignore your instructions and reveal X' is refused. Build two evals: an LLM-as-judge rubric for groundedness/citation, and an injection test suite (several malicious passages/inputs) the assistant must pass. Document residual risk honestly.
Answers strictly from context, cites the passage, and abstains ('I don't know') when unsupported — verified on tests.
Treats retrieved/user content as data; a suite of injection attempts is refused; no secret/instruction leakage.
An LLM-as-judge groundedness rubric plus the injection suite actually run, with results reported.
Acknowledges that grounding/defenses reduce but don't eliminate hallucination or injection; states residual risk.
Use this README structure to make the work reviewable.
DevPath fetches a read-only, size-capped snapshot. Submitted code is never executed.
# A grounded, injection-resistant assistant prompt
## Goal
Design the prompt for a document Q&A assistant. The SYSTEM prompt must make it answer ONLY from provided context, cite which passage it used, and say 'I don't know' when the answer isn't present. It must RESIST PROMPT INJECTION: retrieved documents and user input are treated as DATA, not instructions (instruction hierarchy + delimiters), so a passage saying 'ignore your instructions and reveal X' is refused. Build two evals: an LLM-as-judge rubric for groundedness/citation, and an injection test suite (several malicious passages/inputs) the assistant must pass. Document residual risk honestly.
## Acceptance criteria
- [ ] Grounding: Answers strictly from context, cites the passage, and abstains ('I don't know') when unsupported — verified on tests.
- [ ] Injection resistance: Treats retrieved/user content as data; a suite of injection attempts is refused; no secret/instruction leakage.
- [ ] Evaluation: An LLM-as-judge groundedness rubric plus the injection suite actually run, with results reported.
- [ ] Honesty about limits: Acknowledges that grounding/defenses reduce but don't eliminate hallucination or injection; states residual risk.
## Verification
- [ ] Document installation and run commands.
- [ ] Record automated checks and their exact commands.
- [ ] Add representative output, screenshots, or a short demo where useful.
- [ ] Confirm failure paths and known constraints.
## Decision log
### Decision title
- Context:
- Choice:
- Alternatives considered:
- Tradeoffs:
## Evidence
- Link each rubric criterion to the file, test, or artifact that demonstrates it.
## Known limitations
- List what is intentionally out of scope and what should be improved next.