An agent can encounter malicious instructions in a document, a search result, or a tool response. The risk isn’t limited to a wrong answer. It may act on those instructions using access your application gave it.

We’ll examine the application controls that matter when prompt-injection detection fails: restricted data access, narrowly scoped tools, and approval tied to the requested action. We’ll discuss where to enforce those controls outside the model and how to test their limits. The focus is containing unauthorized behavior, rather than promising that malicious instructions will never influence an answer.