Learn the controls and knobs

Primary knobs for prompt injection: tool allowlists, argument schemas, human approval gates, content delimiters, retrieval trust levels, output filters.

Write a sheet for the tool-using support agent with columns: control, current value, predicted benefit, predicted cost, rollback trigger. Fill it using this topic’s real tension: Blocking suspicious phrases is simple but produces false positives and misses paraphrases. Giving an agent broad tools increases usefulness and blast radius together. Human approval reduces autonomous speed but is appropriate for payments, deletion, disclosure, and external messages.

Change one prompt injection family at a time. If you move two knobs and the tool-using support agent improves, you learned a cocktail, not a cause—and you cannot roll back surgically.

End users of the tool-using support agent should see only safe dials related to prompt injection. Infrastructure limits, private prompts, and policy thresholds stay server-owned. A user-facing control that bypasses those limits is a vulnerability dressed as UX for prompt injection.

Publish the prompt injection control sheet next to the tool-using support agent runbook. On-call should see which knob moved in the last deploy without reading chat archaeology. Unknown prompt injection knobs are unowned knobs.

Also pin one numeric memory from this prompt injection chapter: risk ≈ probability of successful injection × impact of available capability; reducing tool privilege cuts impact even when detection is imperfect That number is not decoration; it is a template for how claims about prompt injection on the tool-using support agent should look in design docs. Scoped specifically to prompt injection / tool-using support agent / controls-and-knobs.

People confuse prompt injection with neighboring buzzwords when debugging the tool-using support agent. Before changing prompts, ask whether the broken stage was evidence gathering, the prompt injection judgment itself, validation, or the product action. Fixing the wrong stage creates folklore (“we tried prompt injection and it failed”) that blocks the next team on the tool-using support agent. Scoped specifically to prompt injection / tool-using support agent / controls-and-knobs.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.