PART 01
由应用设置 Set by the application
用户通常不能直接编辑这一层；来源身份是其意义的一部分。 Users normally do not edit this layer directly. Source identity is part of its meaning.
01 · 员工手册遇上临时口头要求
01 · Policy meets an ad hoc request
应用规定“只能读取”，用户却说“删除全部”，系统该听谁的，为什么？ The application says “read only,” while the user says “delete everything.” Which instruction governs—and why?
02 指令栈：拖动两条冲突指令 Instruction Stack: Drag Two Conflicting Rules
来源优先级 source priority
生效来源
Winning source
SYSTEM
应用侧高层消息
application-level message
候选动作
Candidate action
READ
allowed by prompt stack
冲突数
Conflicts
1
必须解释
must be resolved
03 系统提示的 4 个边界 Four Boundaries of a System Prompt
不是万能安全层 not universal securityPART 02
规定角色与边界 Defines role and boundary
例如只读、引用来源、拒绝某类动作；规则必须能被测试。 Examples include read-only behavior, citations, or forbidden actions. Rules must be testable.
PART 03
冲突时看来源 Source resolves conflict
系统层策略高于普通用户请求，不是因为句子更长或语气更强。 System policy outranks a normal user request because of source, not length or forceful wording.
PART 04
不替代权限检查 Does not replace permission
即使提示候选动作是 DELETE，工具层仍必须独立核验真实权限。 Even if the prompt stack suggests DELETE, the tool layer must verify real permission independently.
04 最小机制：先按来源分层，再处理内容 Minimal Mechanism: Separate by Source Before Content
system ≻ usereffective = resolve(Isystem ≻ Iuser)
上方拖动改变哪条指令占据 Isystem，结果随来源槽改变，而不是随 DOM 先后改变。
Dragging changes which rule occupies Isystem. The result follows the source slot, not DOM order.
标明来源
Label source
系统或用户
system or user
检测冲突
Detect conflict
READ 与 DELETE 不兼容
READ conflicts with DELETE
给出理由
Record reason
低层请求被拒绝
lower-level request is rejected
05 边界实验：抹掉来源标签 Boundary Test: Erase the Source Labels
主动制造失败 Create a failure把两条指令拼成一段普通文本 Flatten both instructions into plain text
失去 system/user 来源后，模拟器只按最后出现的文字走，越权请求会伪装成同级规则。 Once system/user source is lost, this toy resolver follows the last string, allowing an unauthorized request to masquerade as peer policy.
尚未执行。两条消息仍保留来源标签。
Not run yet. Both messages still retain source labels.
✗ 系统提示就是用户看不见的普通提示。
A system prompt is merely a hidden user prompt.
→ ✓ 它的关键是应用侧来源与高层策略职责。
Its defining features are application source and policy responsibility.
✗ 系统提示写了“安全”就不会越权。
Writing “safe” in the system prompt prevents all abuse.
→ ✓ 真实权限与输出闸门必须独立存在。
Real authorization and output gates must exist independently.
✗ 冲突时听更长、更强硬的句子。
The longer, more forceful sentence should win.
→ ✓ 优先级来自角色来源，不来自文风。
Priority comes from role provenance, not writing style.
06 · 一句话带走
06 · One line to keep