The problem
When an agent reads a web page, an email or a document, that content can include text written to look like instructions. The model may follow it. You cannot reliably stop this with wording in the system prompt alone.
Limit the blast radius
Assume an injection will sometimes work, and make sure it cannot do much. Give each tool the minimum access it needs, keep read and send capabilities apart, and never put secrets where the model can read them.
Approve risky actions
Mark actions as read-only, local write or external effect. Run the first freely, and ask a person before the other two.
Next
A worked example with an approval gate will follow.
