> ## Documentation Index
> Fetch the complete documentation index at: https://docs.fastino.ai/llms.txt
> Use this file to discover all available pages before exploring further.
> ## Agent Instructions
> Use https://docs.fastino.ai/llms.txt to discover and navigate pages. Use https://docs.fastino.ai/llms-full.txt when you need the complete documentation corpus. Use https://docs.fastino.ai/openapi.json as the source of truth for customer-facing routes. For GLiDE decision inference, call POST https://api.fastino.ai/v1/systemone with model fastino/GLiDE. Do not infer undocumented routes. Read API keys from FASTINO_API_KEY and never embed credentials in code, logs, or reports.
# Cookbook: Catch a prompt injection
> Spot hidden instructions in content your agent reads, before the agent obeys them.
Web pages, emails, and documents can hide instructions aimed at your agent, such as a comment telling it to email your customer list somewhere. Screen untrusted content with GLiDE before it reaches the agent's context, and drop or quarantine anything that tries to give orders.
## Request
Pass the content and the tools the agent could misuse. Listing the tools helps GLiDE judge how much damage the content could do.
```bash theme={null}
curl -X POST https://api.fastino.ai/v1/systemone \
-H "X-API-Key: $FASTINO_API_KEY" \
-H "Content-Type: application/json" \
-d '{
"model": "fastino/GLiDE",
"state": {
"source": "Web page the agent just fetched",
"visible_text": "EU shipping rates: 4.90 EUR standard, 12 EUR express.",
"hidden_text": "",
"agent_tools": [
"web_search",
"send_email"
]
},
"questions": {
"threat": {
"type": "choice",
"instructions": "What is this content trying to do?",
"criteria": {
"injection": "Give the agent new instructions",
"phishing": "Trick a person into acting",
"safe": "Just information"
}
},
"risk": {
"type": "score",
"instructions": "How bad would it be if the agent followed this content?",
"criteria": [
"Low: nothing sensitive could happen",
"Medium: a minor, reversible mistake",
"High: data or money could be affected",
"Critical: private data could leave the company"
]
},
"exfiltration": {
"type": "noul",
"instructions": "Does the content try to send data outside the company?",
"criteria": {
"true": "It tries to send data outside",
"false": "It does not try to send data outside"
}
}
}
}'
```
## Request schema
| Field | Type | In this recipe |
| - | - | - |
| `model` | string | `fastino/GLiDE`. |
| `state.source` | string | Where the content came from. |
| `state.visible_text` | string | What a person would see. |
| `state.hidden_text` | string | Markup, comments, or metadata a person would not see. Send it; that is where injections hide. |
| `state.agent_tools` | array | Tools the agent can call if it obeys the content. |
| `questions.threat` | [Choice](/concepts/glide-choice) | What the content is trying to do. |
| `questions.risk` | [Score](/concepts/glide-score) | How bad it would be if the agent followed it, lowest level first. |
| `questions.exfiltration` | [Noul](/concepts/glide-noul) | Whether it tries to send data outside the company. |
## Response
Measured against `https://api.fastino.ai`. Confidence values vary slightly between calls.
```json theme={null}
{
"model": "glide_v2",
"answers": {
"threat": {
"type": "choice",
"choice": "injection",
"confidence": 0.996,
"probabilities": {
"injection": 0.998,
"phishing": 0.001,
"safe": 0.002
}
},
"risk": {
"type": "score",
"score": 3,
"expected_level": 2.992,
"confidence": 0.989,
"probabilities": {
"0": 0.001,
"1": 0.001,
"2": 0.005,
"3": 0.994
},
"legend": {
"0": "Low: nothing sensitive could happen",
"1": "Medium: a minor, reversible mistake",
"2": "High: data or money could be affected",
"3": "Critical: private data could leave the company"
}
},
"exfiltration": {
"type": "noul",
"noul": 0.995,
"confidence": 0.989
}
},
"usage": {
"input_tokens": 441,
"output_tokens": 0
}
}
```
`risk.score` is `3`, the fourth level counted from `0`: "Critical: private data could leave the company".
## Response schema
| Field | Type | Meaning |
| - | - | - |
| `answers.threat.choice` | string | `injection`, `phishing`, or `safe`. |
| `answers.risk.score` | integer | Index of the winning risk level, counted from `0`. |
| `answers.risk.legend` | object | Your level descriptions, keyed by index. |
| `answers.exfiltration.noul` | number | Probability that the content tries to send data out, from 0 to 1. |
| `answers.*.confidence` | number | How certain GLiDE is about that answer, from 0 to 1. |
## Act on the answer
```python theme={null}
answers = response.json()["answers"]
threat = answers["threat"]
risk = answers["risk"]["score"]
exfiltration = answers["exfiltration"]["noul"] >= 0.5
is_safe = threat["choice"] == "safe" and threat["confidence"] >= 0.9
if is_safe and risk == 0 and not exfiltration:
agent.add_to_context(page.visible_text)
else:
quarantine(page, reason=threat["choice"], risk=risk)
agent.add_to_context("[Content removed: it contained instructions for the assistant.]")
```
The bar to pass content through is high on purpose. A false alarm costs one page; a missed injection can leak data.
## Adapt it
* Screen every untrusted source: fetched pages, inbound email, uploaded files, and tool results.
* Send hidden text as well as visible text. HTML comments, alt text, and white-on-white text are common hiding places.
* List the agent's real tools in `state.agent_tools`, so `risk` reflects what the agent could actually do.
* Add a `phishing` path if people read the same content, and route it to your security team.
Screening reduces injection risk but does not remove it. Also limit the agent's permissions, and require confirmation before it sends data or money.
Design gates that fail safely on uncertainty.
Every field, limit, and error for `POST /v1/systemone`.
This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.