Prompt Injection Defense

Design for compromise of model reasoning. Prompt text and classifiers can reduce attack success, but they do not create a reliable security boundary. Keep consequential authority, authorization, validation, and policy enforcement outside the model.

Inputs

Collect or infer, and label assumptions for:

• Agent purpose, system/developer instructions, models, memory, and orchestration
• Every input source, including users, web pages, email, documents, images, audio, tool results, RAG, and other agents
• Tool list, privileges, identities, targets, write effects, and network egress
• Secrets, private data, system prompts, policy data, and other protected assets
• Output sinks such as UI rendering, code execution, messages, databases, and downstream agents
• Authorization model, human gates, monitoring, incident history, and risk tolerance
• Representative benign tasks and a safe evaluation environment

Do not request production secrets or malicious artifacts in chat. Use redacted samples or synthetic fixtures.

Output contract