prompt-injection-defense

# Prompt Injection Defense Design for compromise of model reasoning. Prompt text and classifiers can reduce attack success, but they do not create a reliable security boundary. Keep consequential authority, authorization, validation, and policy enforcement outside the model. ## Inputs Collect or infer, and label assumptions for: - Agent purpose, system/developer instructions, models, memory, and orchestration - Every input source, including users, web pages, email, documents, images, audio, tool results, RAG, and other agents - Tool list, privileges, identities, targets, write effects, and network egress - Secrets, private data, system prompts, policy data, and other protected assets - Output sinks such as UI rendering, code execution, messages, databases, and downstream agents - Authorization model, human gates, monitoring, incident history, and risk tolerance - Representative benign tasks and a safe evaluation environment Do not request production secrets or malicious artifacts in chat. Use redacted samples or synthetic fixtures. ## Output contract Deliver: 1. A data-flow and trust-boundary map covering protected assets, all modalities, sinks, memory stores, agent hops, approved destinations, and credential boundaries 2. A threat model listing protected assets, attacker-controlled channels, injection paths, and security invariants 3. A prioritized defense plan that maps each path to preventive, limiting, detective, and recovery controls, each marked `missing`, `plan...