Prompt injection: defence in depth for production AI
Prompt injection is not solved by a better system prompt. What actually reduces risk when models read untrusted content and call tools.
Once an AI feature reads content it did not author — a web page, a PDF, a support ticket — an attacker can write instructions into that content. No system prompt reliably outranks that.
Treat model output as untrusted input
The practical framing: the model is a user with unpredictable intent. Anything it asks your system to do passes through the same authorisation checks a user request would.
Constrain tools, not just prompts
- Give each agent the narrowest set of tools it needs.
- Make destructive or outbound actions require explicit confirmation.
- Scope credentials per task; never hand an agent a broad admin token.
Separate content from instructions
Pass untrusted documents in a clearly delimited channel and instruct the model that content there is data. This is not a guarantee, but it raises the cost of trivial attacks.
Filter both directions
Input guardrails catch obvious injection patterns and PII before it reaches a provider. Output guardrails catch secrets, unsafe content, and unexpected tool arguments before they reach your systems.
Log enough to investigate
Prompt, retrieved context, tool calls, and outcome — retained per policy. Without that trail, an incident review is guesswork.
The honest summary
You are managing risk, not eliminating it. Layered controls at the gateway, tool, and permission level are what make the residual risk acceptable to a security team.