Five Layered Defenses Against Prompt Injection

Sidebar on defending agents against prompt injection: spotlighting (wrap untrusted text in tags), instruction-hierarchy fine-tuning, least-privilege tools, human-in-the-loop approval for sensitive actions, and a planner/executor split (planner never sees untrusted content). Notes production systems like Gmail stack several defenses since no single one is sufficient.