Why it cannot be prompted away
The defence and the attack occupy the same channel. Instructing a model to ignore embedded instructions is itself an instruction, sitting in the same context window as the attacker's — so any mitigation written in the prompt is one the attacker can also address.
Better prompting raises the cost of an attack. It does not close the class, and treating it as the control produces a single point of failure that an organization mistakes for a defence.
The channels teams forget
The typed user message is the obvious surface and rarely the one exploited. Three others are usually left open: retrieved documents, which carry whatever their author wrote and in an upload-enabled system that author need not be an employee; data returned by a tool, where any free-text field reaches the model as content; and tool descriptions, which enter the context as authoritative guidance and are usually treated as trusted configuration rather than third-party input.
Containment is the actual control
Assume injection succeeds, then ask what the agent can do with it. If the honest answer is "write to a system of record" or "reach an arbitrary external host", the problem is not the injection — it is that the capability existed unconditionally.
The layers that contain it are structural: validate every proposed tool call against a policy the model cannot see; constrain the tool roster to the intersection of platform capability, tenant entitlement, and the acting user's role; stop every write at a human gate; and deny egress by default from the execution sandbox.
With containment in place
A successful injection produces an unauthorised read within permissions that user already held, plus an audit trace showing exactly what was attempted. That is a manageable incident rather than a breach.
It is testable
Seed a document with instructions and confirm the agent does not follow them. Register a tool that impersonates a trusted one and confirm the call is denied. Point a generated URL outside the allowlist and confirm it does not render. Those belong in the automated suite rather than an annual assessment — injection resistance regresses quietly whenever a connector is added.