Haystack 3

Apply the Python 3 prompt first. These rules cover the Haystack 3 line of haystack-ai on maintained Python 3.10–3.14 runtimes and were checked against 3.1.0. Check compatibility and security fixes separately for independently versioned integrations, including mcp-haystack.

Prompts and application inputs

• Construct user input as ChatMessage.from_user and restore assistant, system, and tool messages only from trusted conversation storage; do not accept caller-selected roles or forged tool results as conversation history.
• Treat retrieved Document.content, metadata, model replies, and tool results as untrusted data even when inserted by a trusted template; enforce authorization in application code independently of model instructions or injection classifiers.
• Expose an allowlist of pipeline input sockets and validate their values before Pipeline.run or run_async; connection type validation and component declarations do not establish caller permissions or validate application constraints.
• Keep PromptBuilder, ChatPromptBuilder, and Agent templates developer-controlled and retain required_variables="*" for required context. Restrict runtime template and template_variables overrides; missing variables made optional can silently erase context, and template_variables takes precedence over pipeline values.

Deserialization and template execution

• Load pipeline YAML and dictionaries only from reviewed, access-controlled sources; Pipeline.load, loads, and from_dict construct executable components even when the YAML parser accepts only