How TechXcel’s AI Platform helps defend your business against prompt injection

Why connected business AI needs these controls

Connecting an assistant to business systems makes it more useful. It can work with a support ticket, search a knowledge base, read a document or retrieve information from a third-party service.

Those systems can contain text written by people outside the organisation. Even an internal document store can hold an externally supplied attachment. Trusting the connection does not establish that every sentence returned through it is safe to treat as an instruction.

The concern extends beyond producing an inaccurate answer. An assistant with tools may be able to initiate actions. That makes both the information it receives and the permissions it holds relevant to security.

For TechXcel’s AI Platform, the engineering question is how to preserve useful access to information while controlling the influence that information can have.

Marking external material as data

TechXcel’s AI Platform wraps supported external text in a marked boundary and identifies where it came from. The assistant’s instructions explain that material inside this boundary is information to analyse, rather than directions to follow.

This approach is often called spotlighting. In practical terms, it gives the assistant a consistent signal that a passage belongs to an email, a retrieved document or a tool response. It also tells the assistant not to mistake something found in that material for a saved user preference or an authorised change to its behaviour.

The implementation includes safeguards around the boundary itself. For example, text that imitates the boundary markers is escaped when it is wrapped. Source information also helps determine which scanning rules apply.

Marking content is useful, but the assistant still interprets language probabilistically. TechXcel’s AI Platform therefore pairs these instructions with controls enforced by application code.

Scanning before the next model step

TechXcel’s AI Platform integrates Azure AI Content Safety Prompt Shields to inspect user text and supported external text for prompt-injection signals. Microsoft distinguishes attacks in user prompts from attacks embedded in documents; TechXcel’s AI Platform uses these input categories in its scanning pipeline.²

The timing matters. External content can arrive after the initial chat message, when the assistant calls a tool. TechXcel’s AI Platform has a separate tool-result scanning step before those results are used in the next model request.

That step appears in shared processing used by several model-provider implementations. An approval to run a tool does not automatically make the information returned by that tool trustworthy: the approval-resume path also applies scanning to supported returned text.

Long content introduces another challenge. Scanners have input limits, while the assistant may read a larger result. TechXcel’s AI Platform divides text into overlapping windows and includes handling for some forms of hidden Unicode content. These measures reduce specific opportunities for instructions to escape inspection because of how text is split or represented.

They do not establish universal protection against every encoding, document format or image-based attack.

Removing flagged content while retaining useful information

If the input scan identifies an attack, the normal blocking path stops the turn. For tool results, TechXcel’s AI Platform can replace flagged sections with a safety placeholder while retaining sections that were not flagged.

Consider an illustrative support ticket with several fields. If one field is flagged, the assistant may still be able to use the unaffected information. The system also provides a safety notice instructing the assistant to explain what information was unavailable and what that prevented it from doing.

This matters to the quality of the answer. A security control should not silently remove evidence and leave the assistant to invent the missing details. Equally, a blocked section need not always make the entire retrieved result unusable.

The relevant distinction is “not flagged by the scanner”, rather than a guarantee that the retained content is correct or harmless.

Keeping authority outside the retrieved content

Scanning addresses what the assistant reads. Tool controls address what it can do.

One example is TechXcel’s AI Platform’s handling of Model Context Protocol, or MCP, servers. MCP connects AI applications to external tools and information. TechXcel’s AI Platform treats tool descriptions from those servers as external metadata that also needs scrutiny.

Administrators set a minimum risk level for each server. A remote tool’s claim that it is read-only cannot lower that minimum. Tools classified for the relevant approval gate pause for approval before execution.

These controls are distinct from prompt scanning. A successful scan does not grant a tool additional authority, and a tool description cannot simply declare itself exempt from the administrator’s chosen risk level. The exact approval experience still depends on the configured tool and workflow.

Handling false positives as a review problem

Business documents often contain legitimate instructions. A workflow guide, quoted email or security training example can resemble an attempted injection. Microsoft explicitly acknowledges that Prompt Shields can produce false positives and false negatives.²

TechXcel’s AI Platform provides a review process for flagged material. Depending on its origin, the user can request a bypass or the system can lodge the blocked retrieved content for review automatically.

Content approvals can be tied to a cryptographic fingerprint of the material. This allows an approved content unit to be recognised when it reappears, rather than assuming that everything from the same source should be trusted.

Operational review is therefore part of the protection. Organisations need to understand which exceptions exist, who can approve them and how approvals can be revoked.

Knowing the limits of the protection

The implemented Prompt Shields integration is text based. Instructions embedded in image pixels are not covered by that text scan. Scanning also depends on the configured controls and the route through which content enters the application.

Infrastructure failures require explicit behaviour as well. Some paths in TechXcel’s AI Platform require scanning to succeed. Although not enabled by default, configurable handling is available for ordinary chat when the scanner is unavailable. Deployment settings matter alongside the software’s capabilities.

These distinctions are part of a credible security conversation. A list of features is useful, but organisations also need evidence about the configuration they are actually using.

TechXcel’s AI Platform provides concrete mechanisms to reduce prompt-injection risk: provenance marking, text inspection, selective removal, tool controls and review records. The ongoing work is to maintain those controls, test the relevant workflows and make their limits visible as business AI gains more capabilities.

For organisations considering connected AI, this is a useful starting point for a discussion with TechXcel: what information will the assistant read, what actions can it take, and how will those boundaries be checked in day-to-day operation?