Module 04 Summary

What this module established

A template fails on a missing variable before the call; an f-string produces a prompt about None and a confident answer about it. Validate input before the prompt is built, so rejected content never reaches the provider or your logs.

Carry forward

• Never interpolate untrusted text into the system message. Delimit it in the user turn and declare it as data - filtering the attack text is not a control.
• A prompt is behaviour, so version it like code and record the version with every response.
• Test rendering with hostile characters. Template survives a $ where str.format does not.

Before moving on

Move on when every prompt is a versioned template, input is validated before the prompt is built, and you have run an injection attempt against your own app.

Mark complete