A practical starting point.
A request can be structurally valid and still contain instructions that should not control the application. In AI workflows, retrieved documents, user content, and tool responses deserve explicit trust boundaries. Focus on what content can influence and what permissions remain enforced outside the model.
Label the sources
Keep system instructions, user requests, retrieved content, and tool results distinct in the application design.
Constrain the effect
Prevent retrieved text or model output from becoming unrestricted authority to access resources or trigger tools.
Test the boundaries
Exercise realistic untrusted-content scenarios with synthetic data and authorized tools. Check the outcome, not only the model response.
Turn the concept into a review.
Follow the data
Map each source of content and where it can be forwarded. Identify the points where the application interprets data as instructions, queries, markup, or tool parameters.
Keep independent checks
Authorize the requested resource and action at execution time. Limit outbound destinations and sensitive operations using application logic that does not rely on the model agreeing with a prompt.
Review output handling
Treat generated material according to the destination where it will be used. A proposed tool argument and a rendered document need different validation and safety checks.
Questions worth asking.
Can a firewall detect every prompt injection?
No universal guarantee is justified. Request filtering, content checks, model behavior, and execution permissions address different parts of the workflow.
Does prompt security replace authorization?
No. Resource and tool permissions still need server-side checks based on trustworthy context, regardless of what the prompt or output says.
Go deeper in the journal.
Prompt injection and API security: keep untrusted content out of control
Why valid requests can still carry unsafe instructions, and how to protect the boundaries around retrieval, tools, and output.
AI agent least privilege: let the model propose, let policy decide
A permission model for tool-using agents, with scoped identities, specific approvals, and auditable execution.
API security logging: useful evidence without a second data leak
Build decision-focused security events that support investigations without copying production secrets into your logs.