Where the actual trust boundary sits
The boundary isn't between the user and the model — it's between the model and every piece of content it reads that didn't come directly from a trusted, authenticated source. A webpage fetched by a tool, a PDF uploaded by someone else, a third-party API's response, are all untrusted input capable of carrying instructions the model will follow.
Treating a system prompt as a security control against this is the equivalent of trusting a comment in user-submitted HTML not to contain a script tag — it was never designed to hold that line.
The controls that actually work
Separate the channel instructions arrive on from the channel content is read from, so the model has a structural signal distinguishing the two. Scope what tools an agent can call based on the trust level of its current context, and never let content read from an untrusted source trigger a high-privilege action without independent validation.
This is the same tool-gateway pattern covered in our piece on agentic permission models — prompt injection resistance and least-privilege tool access are, practically, the same engineering problem.
If a webpage can instruct your agent, your agent has a supply chain problem — not a wording problem.MNB AI Practice
Key actions
- Treat every non-authenticated content source as untrusted input
- Structurally separate instruction channels from content channels
- Scope tool access to the trust level of the current context
- Never let untrusted content trigger a high-privilege action unvalidated