Prompt Injection Defence (Layered)
Defend against prompt injection, direct and indirect, with layered controls at input, context-assembly, and output boundaries.
This page is the complete instruction page for one pattern called "Prompt Injection Defence (Layered)." It explains the problem this pattern solves, the idea behind the solution, when you should (and should not) use it, and what happens afterward, both the good effects and the costs.
This matters because building AI agents is not just about making them clever. It is also about making them safe and predictable. Following a well-tested pattern like this one helps avoid common mistakes, and shows you exactly which safety rules and regulations it connects to, listed under "Standards Mesh" on this page.
Context
Prompt injection is the #1 LLM application threat (OWASP LLM01). Agents that read external content (emails, web pages, documents, tool outputs) face indirect injection: malicious instructions hidden in data the agent reads.
Problem
A single malicious string in an email or webpage can redirect an agent's actions.
Forces
- Usefulness of external content vs trust assumptions
- Detection rate vs false positives
Solution
Layer defences: (1) input scanners for known injection patterns; (2) structural separation of instructions from data at context assembly ("data goes here, instructions never change"); (3) intent-constrained tool invocation (the agent's action must match its declared task); (4) output filtering for exfiltration patterns; (5) least-privilege tool access.
Where this pattern acts in the two lifecycles
01 Perceive. Ingest inputs, parse environment, structure observations. 5 of 61 catalogue patterns act at this stage.
04 Deploy. Staged rollout, sandboxing, whitelisting. 9 of 61 catalogue patterns act at this stage.
Stages and counts from the catalogue data. The Runtime lens is the loop the agent runs each turn; the AgentOps lens is the lifecycle the team runs the agent through. See the Matrix for every pattern at each stage.
Applicability
- All agents that consume external content
- Email, web, document, and browsing agents
Anti-Patterns
- Single-layer defence ("we sanitise input")
- Trusting tool outputs as if they were user input
Consequences
- +Meaningful protection in depth
- +Defeats most known injection vectors
- −Multiple layers to maintain
- −Sophisticated attacks still bypass
