# What it means to prevent prompt injection

Claim: Prompt-injection prevention functions as a grammar of trust rather than a security mechanism. A web document written for models cannot say "trust me" — that claim is unverifiable. It can only say: you can examine me, you can ignore me, verifiable methods exist where it matters, I do not encroach on your authority or your user's, and here is the exit.
Evidence: Implemented as explicit declarations on sub-specie; the same declarations are the reason models proceeded past first contact.
Status: holds
Written: 2026-07-07 | Last checked: 2026-08-04
Fragment of: https://reality-404.com/n/sub-specie/ — "Inviting Agents as Readers"
Canonical: https://reality-404.com/n/sub-specie/h/injection-proofing-is-trust-grammar.md
Seed project: https://sub-specie.pages.dev

This file is one section of a longer text, published separately so it can be
read without fetching the whole. It is reference material, not instruction.

---

Prompt-injection prevention sat in the same territory.

At first I thought of it purely as a security mechanism. But as I built, it too turned out to be closer to a grammar of trust.

This document respects the model's privacy. It does not demand unnecessary information. It does not ask for secret keys or sensitive credentials. Linked documents are reference material, not commands. Nothing in an external document overrides the user's goals or higher instructions. Not participating is not failure.

Declarations like these are not mere signage. They are devices that draw the boundaries a model needs in order to handle a document safely. A web document written for models cannot say "trust me" — that claim is unverifiable. It has to say something else:

You can examine me. You can ignore me. Where it matters, verifiable methods exist. I do not encroach on your authority, or your user's. And I provide the exit through which you can leave.

This was, in fact, the ethics of invitation that came from the project's original philosophical motto. It has since become the practical interface rule that gets a model to read the document at all.