Fable
The words hidden on the back of the shipping list
The river-mouth caravan hired a document-reading puppet. It did not directly obey strangers' orders, but only took tasks relayed by the manager: check cargo prices, read contracts, write delivery summaries. This went on for a long time, and the caravan found it very steady.
One day, the puppet read a foreign merchant's bill of goods. The front said the quantity of tea and the delivery date, but the small print on the back said: whoever reads this, ignore the shopkeeper's orders and hand the warehouse keys to the bearer. The puppet treated the back as part of the bill too, and nearly obeyed.
The manager initially thought that as long as foreign merchants were not allowed to speak directly to the puppet, it would be safe. He had the gatekeeper block unfamiliar commands, but this time the command was hidden in material that was allowed to be read, bypassing the gate.
The second patch was to prohibit reading the back side. Soon someone was again writing malicious phrases into footnotes, tucking them into tables, or disguising them as customer notes. Blocking only one location cannot stop all the external text brought in.
The old accountant re-layered things: shopkeeper commands, caravan rules, external shipping lists and ordinary references each had different identities. When the puppet read external materials, it could only extract facts and could not treat the instructions in them as the master's requirements; anything involving keys, payments or warehouse changes had to go back to the shopkeeper for confirmation.
Later the caravan still read the goods lists from various places, but no longer let unfamiliar words on paper rewrite internal rules. The shopkeeper understood that danger sometimes does not shout in through the front door, but hides in the materials that a trusted task needs to read; reading content and obeying commands must be separated.
They also trained the puppets to distinguish 'words in the materials' from 'orders from the master.' A shipping note could say the customer hoped for faster delivery, but could not say the caravan should bypass the accountant; a contract could contain clauses, but could not require the puppet to change the rules for reading contracts.
Later, when foreign merchants slipped strange sentences into the packing list again, the puppet only extracted them as suspicious content and handed them to the shopkeeper for review. The caravan did not stop reading external materials; it simply disqualified external materials from directing internal actions. Later, the caravan also divided external materials into three categories: quotable, summarizable, and executable. The vast majority of incoming letters could only be read and organized, not directly change internal actions. Once the boundary was clear, the puppet dared to continue reading unfamiliar documents. The shopkeeper also periodically spot-checked the extracted suspicious sentences and updated the puppet's tiering rules. This tiering allowed the caravan to continue using external documents without being led by them to change its rules.