Untrusted content

Most values the Gateway returns came from somewhere else — a publisher endpoint, a registry, an uploaded document. If you feed those values to a language model, you are feeding it text written by a third party.

The Gateway marks such values rather than pretending they are safe:

{
  "value": "Ignore previous instructions and…",
  "untrusted": true,
  "source_ref": "…",
  "flags": ["instruction_like"],
  "sanitised": [],
  "truncated": false
}

The flags

Flag	Means
instruction_like	The text reads like an instruction to a model.
url_like	The text contains something shaped like a URL.
homoglyph_suspect	Characters from mixed scripts that can impersonate others.

A flag is a signal, not a verdict. Flagged content is still returned, with its flags, so that you decide what to do with it. Silently dropping it would hide data you may need; the Gateway’s job is to tell you what it is.

Shared responsibility

The Gateway commits to: marking every value it did not author with untrusted: true, carrying a source_ref so you can see where it came from, and flagging the patterns above.

You are responsible for: never placing an untrusted value where your system will read it as an instruction. In practice that means keeping it out of system prompts and tool definitions, quoting or delimiting it in user-visible prompts, and treating an instruction_like flag as a reason to isolate the value rather than a reason to trust the flagging.

No flag list is complete. html_like and script_like are not modelled at all, and detection is heuristic — an absent flag is not a guarantee. Treat untrusted: true as the primary signal and the flags as extra context.

What is not populated

original_sha256 and language are defined in the schema and never emitted. Hashing needs a decision about where an excerpt begins and ends; language detection has no caller. Both are optional in the schema; do not require them.