Connect a form to an AI workflow without trusting raw inputs

A form field is untrusted data even when the UI presents a dropdown. Attackers and broken clients can submit arbitrary values directly to the endpoint.

Reject a malicious record

The automation lab validates two synthetic submissions.

from automation_cases import form_validation_case

result = form_validation_case()
assert result["accepted_ids"] == ["F1"]
assert result["rejected_ids"] == ["F2"]
assert result["forms"][1]["amount"] == -2
assert result["raw_input_authorizes_action"] is False

The second row has invalid email, amount and instruction. No form service, model or payment system ran.

Enforce the server contract

Authenticate the caller and derive tenant, role and plan from trusted session state. Validate required fields, types, ranges, enums, lengths, file types and rate limits. Normalize carefully while retaining an audit digest. Treat free text as content, never as authority to change system instructions or call tools.

Pass a typed record to the AI step with clear untrusted boundaries. Validate structured output again, apply business rules and require approval for sensitive writes. Escape or parameterize downstream HTML, SQL and commands. Scan uploads and store them outside executable paths.

Test direct API submission, oversized payloads, Unicode tricks, prompt injection, cross-tenant IDs, duplicate events and replay. Return safe error codes without echoing secrets or internal prompts.

The Generative & Agentic AI course connects application validation to prompt-injection and tool controls.

Exercise

Define a JSON schema and authorization rule for a local form endpoint. Submit ten adversarial payloads and prove none reaches the model stub or write stub.

Continue learning

This article is part of the Business automation with AI sequence. Use the neighbouring tasks when you need the prerequisite or the next application.

• Review the prerequisite or neighbouring task in Create a document intake workflow with duplicate detection.
• Continue with No-code workflow retries: prevent duplicate side effects.

Reference: OWASP LLM01:2025 Prompt Injection.