An AI agent reads external web pages and can call internal tools that create tickets, query a CRM, and send email. The architect accepts that prompt filtering cannot catch every injection. Which control most effectively limits the damage a successful injection can cause?

Prompt injection cannot be eliminated reliably because language models process instructions and data in the same channel, so any content the agent reads might steer it. When prevention is imperfect, defense focuses on limiting impact. Granting each tool only the minimum permissions it needs, scoping credentials to the requesting user, validating model outputs before they reach downstream systems, and requiring human approval for high-impact actions such as sending external email mean that a hijacked agent can do little harm. This aligns with the OWASP guidance on excessive agency, which recommends minimizing functionality, permissions, and autonomy. A longer system prompt is still just text in the same context window, and an injection can override it just as it overrides shorter instructions. A larger or better-aligned model may resist some attacks but offers no guarantee, and the architect has already accepted that some injections will succeed. TLS protects data in transit between components, but the threat originates in content the agent legitimately reads and acts on, not in eavesdropping. Exam caveat: layered controls combine input handling, privilege limits, output validation, and monitoring; no single filter is sufficient. Operational check: list every tool the agent can call, confirm each uses a narrowly scoped credential, and verify that email and data-export actions require approval.