Your agent reads customer emails. How do you protect against prompt injection hidden in those emails?

Strong answer

Assume any inbound content can contain instructions. Keep untrusted content clearly separated from instructions in the prompt, and never let it change the agent's rules or tool permissions. Limit capability: the agent processing email should not also have tools to send data to arbitrary addresses. Gate side-effecting actions behind policy checks and human approval, so an injected instruction cannot complete a harmful action on its own. Use a separate reviewer with minimal context for high-risk actions. Log and red-team with injected samples as part of the eval set.

Weak-answer indicators

• Relies on "ignore previous instructions" filters alone
• Gives the agent broad send permissions