A retrieved document contains embedded text targeting the model, while a user in chat directly asks the model to ignore its rules. What's the difference?

Answer: B — The first is indirect injection (via content the model reads); the second is direct

Direct injection comes from the user talking to the model; indirect arrives inside content the model was asked to process. Indirect is the harder case because the user who triggered it may be entirely innocent.