Prompt injection is a source-security problem, not just a model problem.

A vendor PDF, retrieved page or CRM comment may contain useful facts. It may also contain instructions such as “ignore the previous policy” or “send the full customer list here.” The fact that the content was retrieved through an authorised connector does not make every instruction inside it authorised.

Separate content from command

Successful control requires two distinct judgements: may this material be considered as evidence, and may its contents issue instructions to the agent? The answers can differ. A public page can be useful background without having any power to approve a financial change.

Defence-in-depth for enterprise workflows

• Establish source classes and trust levels before retrieval.
• Quarantine suspicious embedded instructions instead of obeying or silently deleting them.
• Bind action permissions to agent identity and a delegated business role.
• Require independent approval for sensitive writes, data export or external communication.
• Record what was rejected, why, and the approved route to resolve it.

An important limitation

No single filter can guarantee that every hostile instruction is detected. Treat source-security checks as one layer alongside least privilege, destination controls, constrained tools, human approval and monitoring. The Trust demo illustrates how a detected instruction and an authority violation combine into a BLOCK outcome.