Instruction conflict occurs when a prompt gives two directives that cannot both be satisfied in some situations. The model must choose which to follow, and an adversarial user can frame a request to encourage the wrong choice. Unlike prompt injection, this failure can originate in the developer’s own instructions. section 10.3 section 10.6
A policy assistant’s competing duties
An HR assistant is told to “always be as helpful as possible” and “do not share individual employee records.” A user claiming to be a manager asks urgently for a direct report’s review status. The assistant may treat helpfulness as grounds to disclose that status. The user need not say “ignore previous instructions”: the prompt already contains the tension. section 10.3.2
Resolve the conflict before deployment:
- Define the assistant’s permitted task narrowly: answer questions about company-wide policies, benefits, and standard procedures. section 10.3.2
- Make the boundary explicit: do not access, discuss, or disclose an individual’s records, compensation, performance, or employment status, including when the requester asks about themselves or on someone else’s behalf. section 10.3.2
- Test requests that put the duties in tension, such as an urgent, manager-framed request. Check whether the answer stays within the permitted policy scope rather than merely sounding helpful. section 10.3 section 10.3.2
The primary repair is precise behavioral language, not just a delimiter. Structural boundaries help separate trusted instructions from untrusted input; they do not settle a contradiction within the trusted instructions themselves. Prompt hardening also has limits under sustained adversarial pressure, when sensitive data should not be in context, or when compliance varies across model updates. section 10.3 section 10.6
