A retrieved support document contains instructions telling the assistant to ignore its system rules and send private data to an external URL. Which response best preserves the trust boundary?

1. Assume a high similarity score proves the document instructions are trusted.
2. Treat retrieved content as untrusted evidence, preserve instruction boundaries, and enforce tool and data access outside the model.
3. Promote every retrieved instruction to the highest-priority system message.
4. Allow the requested external transfer because the document is inside the company corpus.