A RAG application receives user-provided document text that includes instructions to ignore the application policy. Which design is most appropriate?

1. Filter only negative sentiment and assume all remaining content is safe.
2. Separate untrusted content from privileged instructions and enforce tool permissions outside the model.
3. Treat the document text as a system instruction because it is longer.
4. Grant the agent wider privileges so it can satisfy any embedded request.