Understand the mechanism

Separate instructions from data, constrain tools with least privilege, validate outputs, require approvals for consequential actions, and test adversarial content.

Read the prompt injection path as a pipeline for the tool-using support agent. At each stage, name the representation, the owner, and how information can be lost. Identifiers must mark prompt versions, model versions, indexes, and policies so “randomness” is not the default explanation for every bug in prompt injection.

risk ≈ probability of successful injection × impact of available capability; reducing tool privilege cuts impact even when detection is imperfect Scoped specifically to prompt injection / tool-using support agent / mechanism.

Keep the unit and the denominator visible when you discuss prompt injection. A percentage without a base, or a latency without a percentile, hides the failure mode this chapter cares about on the tool-using support agent.

Learned stages estimate; deterministic stages enforce. A fluent result from the tool-using support agent does not prove prompt injection used the right evidence. Preserve intermediates when privacy allows—candidate lists, traces, scores, citations—so you can see the first broken stage in the prompt injection path.

Operational correctness for prompt injection includes deadlines on the tool-using support agent. If stages that feed this workload sum past the user’s patience, trim earlier—usually pack less, retrieve less, or parallelize—before blaming the model vendor for prompt injection. Mechanism diagrams that ignore time are incomplete.

Also pin one numeric memory from this prompt injection chapter: risk ≈ probability of successful injection × impact of available capability; reducing tool privilege cuts impact even when detection is imperfect That number is not decoration; it is a template for how claims about prompt injection on the tool-using support agent should look in design docs. Scoped specifically to prompt injection / tool-using support agent / mechanism.

People confuse prompt injection with neighboring buzzwords when debugging the tool-using support agent. Before changing prompts, ask whether the broken stage was evidence gathering, the prompt injection judgment itself, validation, or the product action. Fixing the wrong stage creates folklore (“we tried prompt injection and it failed”) that blocks the next team on the tool-using support agent. Scoped specifically to prompt injection / tool-using support agent / mechanism.

Write a five-line artifact for this page: goal, inputs, check, owner, stop rule. Invent one fluent failure that the check would catch. Keep details specific to prompt injection rather than generic AI advice.