No defence closes prompt injection, and every serious source says so. What exists is a stack of layers, each of which reduces the attack and each of which has a documented way through. So a layer is judged by what it still lets through, not by what it blocks.
Filtering and injection classifiers
What it does. A classifier reads the input, the retrieved content, or the output, and refuses text that matches a known injection pattern. It catches published payloads and encoded variants, raising the cost of a casual attack. OWASP lists input and output filtering among its own mitigations for LLM01 (OWASP).
What it still lets through. The classifier is the exact thing an adaptive attacker optimises against, and it reads the same undifferentiated text stream the model could not parse. Out-of-band defences re-evaluated against an attacker allowed to adapt lose much of their headline effect (arXiv 2606.26479). Simon Willison's verdict on the catch rates vendors advertise is the one to keep: in security, "95% is very much a failing grade" (Willison).
Instruction hierarchy, prompt hardening and adversarial training
What it does. The model is trained and prompted to rank the developer's instruction above anything it later reads, and to treat retrieved content as data. This is where frontier labs spend their effort, and the effect is measurable: OpenAI reports an 8.5% attack success rate within 15 attempts on 1,810 curated indirect injection attacks, against 27.0% for its previous model (GPT-6 Astra system card).
What it still lets through. The lab's own number is not zero, and it is measured on a curated benchmark rather than on your workflow. A hierarchy is a preference the model usually honours, not a boundary the runtime enforces.
Marking provenance: spotlighting, delimiters, source tagging
What it does. Untrusted content is wrapped, tagged or encoded so the model can tell which span came from a document and which from you. It lowers success rates and costs almost nothing to add.
What it still lets through. The marker is advisory. An instruction written in your own voice inside the marked span still competes for attention, and nothing in the architecture stops the model from crossing the mark.
Least privilege and tool allowlisting
What it does. The agent gets the smallest set of tools and the narrowest scopes the task needs. It is the highest-value cheap control here, and the one OWASP names in LLM06 against excessive functionality and excessive permissions (OWASP LLM06).
What it still lets through. Whatever remains. Willison's lethal trifecta names the combination that matters: access to private data, exposure to untrusted content, and the ability to communicate externally (Willison). One tool that reads and one tool that writes somewhere an attacker can see is already an exfiltration path, and both may be tools the task needs.
The dual LLM pattern
What it does. Two models, one job each. The privileged model plans and holds the tools and never sees raw untrusted text. The quarantined model handles the untrusted content and holds no tools; Willison's original description is that it "is expected to have the potential to go rogue at any moment" (Willison, 2023). This is containment by structure rather than by probability.
What it still lets through. It constrains what the assistant can do at all, since the planner works from symbols it never reads. Any leak of unfiltered quarantined output into the privileged context restores the vulnerability.
Capability enforcement at the tool call: CaMeL
What it does. CaMeL extracts the control flow and data flow from the trusted query, so untrusted data cannot influence program flow, then uses capabilities to enforce security policies when tools are called (arXiv 2503.18813, code). It is the strongest published result in this family: 77% of AgentDojo tasks solved with provable security. The information-flow control literature reaches the same place from the other direction (arXiv 2505.23643).
What it still lets through. Someone has to write the policies, and the guarantee is about data flow rather than judgement. An action the policy permits is permitted even when an injected instruction asked for it.
Sandboxing and egress control
What it does. The agent runs where it can reach little: no outbound network, a scratch filesystem, credentials that expire. It removes whole categories of exfiltration path.
What it still lets through. The third leg of the trifecta does not have to be the network. Writing attacker-readable text into a record your own product exposes is exfiltration with no egress at all.
Limiting the combination: Meta's Rule of Two
What it does. An agent may satisfy at most two of three properties in one session: processing untrusted input, access to sensitive data or systems, and the ability to change state or communicate externally. Meta's own wording: "An agent operating without human approval is allowed to satisfy two of the three. Combining all three requires a human in the loop" (Meta).
What it still lets through. It is a design constraint, not a detector, enforced by whoever designed the session. Meeting it means giving up capability or adding an approval, which is why most useful agents satisfy all three.
A signature from a person on high-impact actions
What it does. OWASP LLM06's headline mitigation, verbatim: "Utilise human-in-the-loop control to require a human to approve high-impact actions before they are taken." It is the only layer whose effect does not depend on having recognised the attack.
What it still lets through. OWASP's own agentic threat list names T10, Overwhelming Human in the Loop: an approval surface that fires constantly is itself the attack surface, and a fluent, confident explanation is a persuasion channel (OWASP). The control works when the holds are few, high-signal, and about actions nobody can take back.
Logging and monitoring
What it does. The only layer that still functions after the attack succeeded, and what turns an incident into something reviewable.
What it still lets through. OWASP names T8, Repudiation and Untraceability. A log written by the acting system is that system's own claim about what it did, and an agent that misrepresents its actions writes a log that agrees with it.
How do you rank these for your own rollout?
By how each one fails. Text-level layers degrade quietly against an adaptive attacker: protection is lost without an alarm. Structural layers fail loudly, by refusing work. Prefer the loud ones for anything irreversible.
More depth: prompt injection in AI agents, what the guardrail frameworks do, and how to measure any of this.
Which layer works when all the others have failed?
The one that never read the text. That is the layer ZIFFER is.
The agent holds no credential, so a successful injection ends with a proposal rather than an effect. The proposal is graded against your signed policy, and every value the decision turns on is recomputed from that policy rather than taken from the proposal. Irreversible actions are held for a quorum of two named humans who sign the exact bytes that will run, and a hold nobody signs expires with nothing run. Every outcome, refusals included, leaves a signed receipt.
ZIFFER is not a guardrail and detects no injection. It grades a proposed action and records the answer. See agent authorization, the agent audit trail and every refusal.