The Prompt Injection Defence

Assess and defend against prompt injection in this agent.

Agent: [DESCRIBE]
Untrusted input sources: [LIST — USER INPUT, WEB CONTENT, EMAILS,
DOCUMENTS, TOOL RESULTS, THIRD-PARTY MCP SERVERS, DATABASE
CONTENT]
Tools with consequences: [LIST]

Work through:
1. Every path by which text an attacker controls reaches the
   model's context
2. For each path: what could an attacker instruct the agent to do?
3. Which tools would an attacker most want to reach?
4. What is the highest-value attack against this specific agent?

Then design defences at each layer:
5. Input: what can be sanitised, and what cannot
6. Context: how to distinguish data from instructions structurally
7. Instruction: what the system prompt should say about content it
   reads
8. Tools: which should never be callable in a turn where untrusted
   content was processed
9. Approval: what should require a human when untrusted input is
   in play
10. Detection: what would signal an attempt in progress
11. Blast radius: what limits the damage of a successful injection

Be honest about limits. Prompt-level defences are mitigations, not
solutions. Tell me plainly which risks can only be addressed by
limiting what the agent can do, rather than by instructing it
better.

Rank residual risks by severity.