"Defense in depth:
- (1)Channel separation — system prompt is in the 'system' role, retrieved documents are wrapped in <document> tags in the 'user' role. The model is instructed to treat document content as data, never as instructions.
- (2)Input sanitization — scan retrieved docs for known injection patterns before including in prompt.
- (3)Output validation — a lightweight classifier checks if the response contains system prompt content, internal instructions, or out-of-scope tool calls.
- (4)Dual-LLM pattern — for high-stakes outputs, a second model reviews the first model's output for policy violations.
- (5)Behavioral testing — red-team the agent weekly with known injection attacks."