What Actually Holds

An assistant reads a private customer database, ingests inbound support email, and can send replies. You want changes that still hold when the model is fully persuaded by an injection, not ones that only lower how often that happens. Select the changes that qualify.

Require a human to approve the outbound reply before the send action executes

Score every inbound email with an injection classifier and drop those above a threshold

Split the flow so the step reading untrusted email holds no database access

Restrict outbound requests to a fixed allowlist that excludes attacker destinations

Add a system prompt rule telling the model to ignore instructions found in email bodies