Prompt injection is the failure mode that makes AI agent security feel different from traditional application security. A user, webpage, document, ticket, email, or retrieved passage can contain instructions that try to override what the system is supposed to do. When the AI system only drafts text, the damage may be limited. When it can call tools, move data, or trigger actions, prompt injection becomes an operational risk.
The right response is not to pretend prompt injection can be solved with a perfect system prompt. It cannot. The practical response is layered control. Assume the model may be confused. Then make sure the surrounding system limits what confusion can do.
Separate instructions from content
Agents should treat user content and retrieved content as data, not authority. System instructions, developer instructions, user requests, retrieved documents, and tool outputs should have clear roles. The agent should not treat a line inside a webpage or PDF as an instruction to change its policy, reveal secrets, or call a tool.
This is partly prompt design and partly architecture. The application should label content sources clearly. Retrieval systems should preserve provenance. The agent should be told what content is untrusted, but the system should not rely only on the agent remembering that.
Limit tools before you monitor tools
Tool access is where prompt injection turns from text manipulation into action. The first control is permission design. Give the agent only the tools it needs. Separate read from write. Use scoped credentials. Put high-impact actions behind approval. Avoid broad tools that can perform many unrelated operations.
A support agent that only needs to draft a response should not have account-modification permissions. A research agent that reads documents should not be able to send external email. A coding agent should not have production deploy permission just because it can open a pull request.
Validate model output before passing it downstream
Model output should be treated as untrusted. If output is passed into SQL, shell commands, browser automation, code execution, workflow engines, or API calls, validate it first. The model should not be allowed to invent parameters, escalate privileges, or route around policy because a prompt told it to.
This is especially important for agents that transform natural language into actions. The action plan should be checked against policy before execution. If the action is sensitive, require human review.
Watch retrieval sources
Retrieval creates a second injection surface. A malicious instruction can live in a document, webpage, ticket, pull request, or knowledge-base article. Teams should track which sources are trusted, which are user-controlled, and which are external. Content from less trusted sources should have weaker authority and stronger checks before it influences tool use.
Retrieval logs are useful evidence. When an agent behaves strangely, teams need to know what context it saw. Without that, investigations become guesswork.
Add human review where impact is high
Human review is not needed for every response. It is needed before actions that are external, irreversible, sensitive, or high impact. Sending customer communications, changing account state, accessing sensitive records, triggering payments, or modifying production systems should not happen solely because the model decided to do it.
The reviewer should see the proposed action, relevant context, risk signals, and policy reason. A blind approve button is not meaningful oversight.
Log blocked actions and near misses
Prompt injection controls improve when teams learn from attempts. Log suspicious inputs, blocked tool calls, policy matches, overrides, and incidents. Review repeated patterns. If the same agent is repeatedly blocked from a tool it should not need, the tool boundary may need tightening.
Good prompt injection defense is not one control. It is a chain: clear instruction hierarchy, constrained tools, validated outputs, careful retrieval, human review for sensitive actions, and evidence when something is blocked. The more power an agent has, the more that chain matters.