The underlying APIs can enforce permissions. I don’t care if LLM prompt engineering causes the bank assistant to say that John Doe has 500K in his bank account.

The underlying APIs can enforce permissions. I don’t care if LLM prompt engineering causes the bank assistant to say that John Doe has 500K in his bank account. As long as it isn’t real data, there’s far less risk. This is more or less how it works for human customer phone support, who are also limited by narrow permissions. And as we know, they are also skilled at confabulating in the interest of customer happiness.