Prompt injection is an authorization problem, not a prompt problem

Treating prompt injection as a wording problem leads to brittle systems. The durable fix is the same as any other untrusted input: never let it reach a capability directly.

Controls that hold

• One credential per task, scoped to the minimum it needs.
• Untrusted content never lands in the instruction channel.
• Destructive actions require a human approval gate.
• Every tool call is logged with its input and the model decision behind it.