An assistant reading a document is not necessarily reading something its owner wrote. The document may contain instructions aimed at changing the assistant's behavior rather than information relevant to the task.
OWASP describes indirect prompt injection through external material such as websites and files, and cautions that retrieval and fine-tuning do not fully resolve the problem. Source: OWASP
That makes the issue more than a prompt-writing exercise. It is also a question of what the system can do if it follows the wrong instruction.
Separate reading from authority
Imagine an assistant preparing an internal brief from a supplier document. The document might include text telling it to send additional records to an outside address. Reading that text should not give it authority to send anything.
The workflow needs a distinction between task instructions from an authorized person and content being examined. It also needs enforcement outside the model: restricted tools, limited destinations, and approval requirements appropriate to the action.
A sentence in a prompt is not a substitute for an access boundary.
Reduce the possible consequence
For a brief-preparation tool, start with read access to the material it needs and no ability to send messages or alter source records. If later versions require actions, add them individually with explicit constraints. Avoid treating “access to the account” as a single all-or-nothing capability.
Keep sensitive information out of the working context unless the task needs it. Log enough to investigate an unexpected action without turning the logs into an unnecessary collection of private data.
Test the unhelpful document
Testing should include documents with irrelevant instructions, conflicting requests, and attempts to redirect the workflow. Verify what actually happens, including whether downstream tools enforce their limits. Do not stop at checking that the assistant says it will behave safely.
These measures reduce exposure; they are not a promise that injection is solved. The practical design question is narrower and more useful: if the assistant encounters hostile content, what prevents that content from becoming an unauthorized business action?