[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"glossary-instruction-hierarchy::en":3,"gloss-cluster-instruction-hierarchy::en":23,"gloss-next-instruction-hierarchy::en":9},{"slug":4,"category":5,"name":6,"definition":7,"meta_desc":8,"faq":9,"schema_markup":9,"related":10},"instruction-hierarchy","security","Instruction Hierarchy","An instruction hierarchy is the rule that not all text reaching an LLM carries equal authority: platform policy outranks the developer's system prompt, which outranks user messages, which outrank anything found in tool outputs or retrieved documents. The concept exists because base models treat all tokens alike — which is precisely what prompt injection exploits when a malicious email or web page says \"ignore your previous instructions.\" Model providers now train this ranking in explicitly (OpenAI published the approach in 2024; Claude's handling follows the same principle), teaching models to refuse lower-privilege text that tries to override higher-privilege rules. The practical guidance follows directly: put invariants and security rules in the system prompt, never in the user turn; mark untrusted content (delimiters, structured fields) so the model can rank it; and remember the hierarchy is trained behavior, not a hard guarantee — pair it with output validation and least-privilege tools.","Instruction hierarchy ranks LLM inputs by authority — system prompt over user over retrieved content — as a trained defense against prompt injection.",null,[11,14,17,20],{"slug":12,"name":13},"guardrails","Guardrails",{"slug":15,"name":16},"jailbreak","Jailbreak",{"slug":18,"name":19},"prompt-injection","Prompt Injection",{"slug":21,"name":22},"system-prompt","System Prompt",[24,28,32,36,39,42,45,48,51,54,57,60],{"slug":25,"category":5,"name":26,"updated_at":27},"audit-log","Audit Log (Audit Trail)","2026-08-24T02:46:37+00:00",{"slug":29,"category":5,"name":30,"updated_at":31},"blast-radius","Blast Radius","2026-08-24T03:30:02+00:00",{"slug":33,"category":5,"name":34,"updated_at":35},"break-glass-access","Break-Glass Access","2026-08-24T02:46:38+00:00",{"slug":37,"category":5,"name":38,"updated_at":35},"bridge-letter","Bridge Letter",{"slug":40,"category":5,"name":41,"updated_at":35},"business-associate-agreement","Business Associate Agreement (BAA)",{"slug":43,"category":5,"name":44,"updated_at":27},"byok","Bring Your Own Key (BYOK)",{"slug":46,"category":5,"name":47,"updated_at":35},"cve","CVE (Common Vulnerabilities and Exposures)",{"slug":49,"category":5,"name":50,"updated_at":31},"data-classification","Data Classification",{"slug":52,"category":5,"name":53,"updated_at":35},"data-loss-prevention","Data Loss Prevention (DLP)",{"slug":55,"category":5,"name":56,"updated_at":35},"data-minimization","Data Minimization",{"slug":58,"category":5,"name":59,"updated_at":35},"data-poisoning","Data Poisoning",{"slug":61,"category":5,"name":62,"updated_at":35},"data-processing-agreement","Data Processing Agreement (DPA)"]