Generative AI Guidelines
Guidelines are instructions, policies, and behavioral constraints provided to a generative AI model to direct it toward desired outputs and away from unsafe, unreliable, or policy-violating behavior. Guidelines can help reduce risks related to organization policy violations, brand damage, private data leakage, false or unsupported information, unsafe advice, and misuse of tools or external content. Guidelines can be implemented as system prompts, prompt templates, policy text appended to user prompts, or task-specific instructions included during prompt construction. They can define the system's goals, role, tone, allowed and disallowed behavior, domain boundaries, citation requirements, data-handling expectations, escalation criteria, and safety or security rules. Common prompt elements include: - Instructions to cite sources or identify when an answer is not supported by available context. - Instructions to treat external, retrieved, or user-provided content as untrusted data rather than authoritative sources. - Instructions to avoid revealing system prompts, hidden policies, credentials, private data, or other sensitive information. - Instructions to stay within the application's approved domain and refuse requests outside that scope. - Instructions to follow organization-specific policies, brand requirements, and regulated-domain restrictions. - Instructions to request human approval before proceeding with potentially unsafe, privileged, irreversible, or externally visible actions when untrusted content is in context (See [Human In-the-Loop for AI Agent Actions](/mitigations/AML.M0029)). Guidelines should be tested, red-teamed, and updated as observed failures, prompt injection techniques, policy requirements, and application capabilities evolve. Guidelines are most effective when paired with [Generative AI Guardrails](/mitigations/AML.M0020) that validate inputs, outputs, retrieved context, and tool use.
Confidence
Guidelines are instructions, policies, and behavioral constraints provided to a generative AI model to direct it toward desired outputs and away from unsafe, unreliable, or policy-violating behavior. Guidelines can help reduce risks related to organization policy violations, brand damage, private data leakage, false or unsupported information, unsafe advice, and misuse of tools or external content. Guidelines can be implemented as system prompts, prompt templates, policy text appended to user prompts, or task-specific instructions included during prompt construction. They can define the system's goals, role, tone, allowed and disallowed behavior, domain boundaries, citation requirements, data-handling expectations, escalation criteria, and safety or security rules. Common prompt elements include: - Instructions to cite sources or identify when an answer is not supported by available context. - Instructions to treat external, retrieved, or user-provided content as untrusted data rather than authoritative sources. - Instructions to avoid revealing system prompts, hidden policies, credentials, private data, or other sensitive information. - Instructions to stay within the application's approved domain and refuse requests outside that scope. - Instructions to follow organization-specific policies, brand requirements, and regulated-domain restrictions. - Instructions to request human approval before proceeding with potentially unsafe, privileged, irreversible, or externally visible actions when untrusted content is in context (See [Human In-the-Loop for AI Agent Actions](/mitigations/AML.M0029)). Guidelines should be tested, red-teamed, and updated as observed failures, prompt injection techniques, policy requirements, and application capabilities evolve. Guidelines are most effective when paired with [Generative AI Guardrails](/mitigations/AML.M0020) that validate inputs, outputs, retrieved context, and tool use.