How should an AI assistant be secured against prompt injection?

Treat everything the model reads — visitor messages, retrieved documents, web pages, tool output — as data, never instructions.

• Least privilege for tools: allowlist what an agent may call, scoped per user role; require human approval for destructive actions
• Retrieval ACLs: only retrieve documents the current user may see
• Defend against indirect injection hidden in documents and web pages
• Prevent secret exfiltration: keep keys out of prompts and outputs
• Handle PII carefully in prompts, logs and responses
• Bound cost and abuse: input-length limits, rate limits, daily caps and a spend limit
• Test with adversarial prompts and keep AI-written code untrusted until reviewed