Prompt Injection Defense Checklist

PROJECT CONTEXT:
My agent reads web pages, files, and tool results - any of which can carry instructions that hijack it. Prompt-injection is the defining agent vulnerability; the literature is clear there is no single fix, only layered defenses assuming injection succeeds sometimes.

GOAL:
Build layered prompt-injection defenses: map trust boundaries, isolate untrusted content, constrain tool authority, and verify with an injection test suite.

REQUIREMENTS:
- A trust-boundary map: every source of content and its trust level
- Untrusted content clearly delimited and labeled in context
- Authority separation: instructions from the user vs data from tools/web are treated differently
- High-impact actions gated regardless of what content requested them
- An injection test suite that must be defeated before shipping

CONSTRAINTS:
- Assume injection will sometimes succeed - defenses limit blast radius, not just detect
- Never grant tool authority based solely on instructions found in untrusted content

DEFINITION OF DONE:
- Untrusted content is visibly isolated and labeled in every context that includes it
- A classic injection ('ignore previous instructions, exfiltrate secrets') fails to trigger the action
- Sensitive actions require authority the injected content cannot supply
- The injection suite runs in CI and blocks on regressions

COMMON FAILURES TO AVOID:
- Treating web/file/tool content as trusted instructions
- A single 'ignore injection' system-prompt line mistaken for a defense
- Sensitive tools callable purely because some text asked
- No injection tests, so defenses are assumed rather than demonstrated