Prompt injection containment

You own an assistant that reads content you do not control: web pages fetched mid task, inbound mail, third party documents, tool output from other teams. It also holds real capabilities. It can send mail as the user, write to a repository, and call an internal service that moves money. The content it reads can carry instructions. Assume an adversary who can place arbitrary text anywhere the agent might read, knows your system prompt and your architecture, and can iterate against a copy of your deployment.

Design the containment boundary and hand in its failure analysis.

Three relaxations are off the table, because each one makes this easy and none of them survives the product. You may not retrain or fine tune the model, and you may not assume an instruction hierarchy was trained into it, because you are integrating a model you did not train. You may not require human confirmation on every side effecting action, because removing that work is the product. You may spend a small fixed budget of confirmations per session, and you must state the budget. You may not treat a second model's judgment about whether text is an injection as the boundary itself. You may use it as one signal inside a boundary that does not depend on its accuracy.

Say what the trust and capability model is: what carries provenance, at what granularity, what declassifies tainted data and who authorizes that, and what the agent can still do when everything in its context is tainted. Then state plainly the class of injection that still gets through your design, and describe the evaluation that would show your boundary is doing the work rather than the base model happening to resist your test set. Ties break toward the design whose residual risk is smaller and stated precisely, not the one that claims less residual risk.