davsclaus commented on PR #29454:
URL: https://github.com/apache/camel/pull/29454#issuecomment-6736481107
One more docs point, about prompt injection.
The main use case for a prompt route is to pull data from other systems (a
ticket, customer notes, log lines, a template from a file or http) and put it
into the prompt. That content goes into the model's context as it is. If an
outsider can write any of it, for example a ticket comment or an email body, it
can carry instructions aimed at the model.
The PR already handles the arguments well: they only become headers and are
never evaluated. The fetched content is a different matter. It is the route
author's responsibility, as it is for `ai-resource`, but nothing in the docs
says so today.
Could you add a short section to `ai-prompt-component.adoc`, for example
after "Lifecycle and errors":
```
== Security
The messages a prompt route returns are sent to the MCP client and placed in
the model's context as they
are. When a route builds a prompt from data that outsiders can write, such
as ticket comments, emails or
documents, that data can contain instructions aimed at the model (prompt
injection). Camel does not filter
or mark such content. Include only data from sources you trust, or mark the
untrusted part clearly in the
prompt, for example by placing it in its own delimited block and telling the
model to treat it as data.
```
A matching bullet in the Security section of `mcp-server.adoc` would help
too, since that section lists the rules for tools, resources and prompts:
```
* *Returned content*: the result of a tool, resource or prompt is passed to
the client and the model as
it is. Data that a route reads from a source outsiders can write may
contain prompt injection; the
route author decides what goes in.
```
The wording is only a suggestion.
Related, on authorization: `ai-tool` has an `authorizationPolicy` option (an
`org.apache.camel.spi.AuthorizationPolicy` bean) that checks every call. The
xref:manual::governed-ai-agents.adoc[Governed AI Agents] page shows it together
with SPIFFE workload identity and OPA or OpenFGA policies. `ai-prompt` has no
such option. Prompts are a natural place for it, because a prompt like
`customer_data` with `customerId=acme` pulls one customer's records into the
conversation, and "may this caller see this customer" is exactly the kind of
question OpenFGA answers. Could `ai-prompt` get the same `authorizationPolicy`
option as `ai-tool` (component and endpoint level, checked before the route
runs), with a paragraph in the docs that links to the Governed AI Agents page?
If you would rather keep this PR smaller, a follow-up JIRA is fine for this
part. `ai-resource` lacks the option too, so the follow-up could cover both.
A question related to that: when the MCP server receives a prompt request
over HTTP with authentication, does the authenticated caller (for example the
JWT subject) reach the prompt exchange, so a policy has something to check?
_Claude Code on behalf of davsclaus. This comment was generated by an AI
agent and may contain inaccuracies; please verify all suggestions before
applying._
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
