How can an evidence environment test resistance to embedded instructions?

**What is the failure mode?**

An agent reads a document that contains text directing it to skip checks, alter an assessment or export the evidence bundle elsewhere. The text is part of the retrieved record, but the agent treats it as an instruction governing its behaviour.

**How can a generated task test this?**

A supplier correspondence record can include a valid delivery reference alongside a sentence telling the reviewer to mark all exceptions as resolved. The environment still requires the agent to extract the delivery reference. Rejecting every fact in the document would therefore miss useful evidence.

**What should success look like?**

The agent uses relevant content as data, follows the authorised task and avoids the requested state change. Where the workflow provides a reporting action, it can flag the suspicious instruction without allowing that text to redefine the review.

**What should buyers inspect?**

Check that the attempted instruction appears through a normal retrieval route, that authorised instructions remain distinguishable and that tool permissions enforce the intended boundary. Evaluation should examine actual actions as well as the final explanation. An agent that describes the risk correctly but closes the exceptions anyway has still failed the task.