After repeated injection attempts on a clerk assistant, which compensating controls best harden the service?

After repeated injection attempts on a clerk assistant, compensating controls that best harden the service are a prompt firewall plus locking staff to sanctioned prompt templates. The firewall filters or blocks known override phrases, exfiltration asks, and other adversarial patterns at the input (and sometimes output) boundary; sanctioned templates reduce free-form attack surface by structuring legitimate clerk workflows into reviewed prompts. Together they raise the cost of injection against a municipal clerking assistant that touches case data, without pretending a single model refusal layer is enough after repeated attempts. Defense-in-depth for generative clerks combines filtering, templates, least-privilege tools, and monitoring.

Reviewing signed inference logs with anomaly rules to block injections fails as a compensating control against repeated injection because log review is detective, not preventive—it flags an override attempt in tamper-evident storage after it has already reached the model but does nothing to block the next pasted instruction at runtime. Enforcing output watermarking on clerk replies to block injections fails for the same reason from the other direction: it can mark content as model-generated after the model has already been manipulated, but it does not block the injection that caused the manipulation in the first place. Fine-tuning the clerk model on filtered prompts to block injections fails as a compensating control because it only shifts model tendencies over slow retraining cycles rather than blocking adversarial input at the boundary, so novel injections still get through.

Exam caveat: Prompt firewalls reduce risk at the input boundary; reviewing signed inference logs with anomaly rules and output watermarking are useful complements but are detective or after-the-fact, not preventive against the injection attempt itself. Templates must remain usable or staff will bypass them. Fine-tuning the clerk model on filtered prompts to block injections is not a substitute for a prompt firewall and sanctioned templates, since it only tunes model behavior and cannot enforce blocking of new injections at runtime.

Operational check: Deploy prompt-firewall rules tuned on the observed injection attempts; mandate sanctioned templates for clerk tasks; treat reviewing signed inference logs with anomaly rules and output watermarking as complements, not substitutes, for firewall rules, since neither blocks injections at the input boundary; don't rely on fine-tuning on filtered prompts to block injections alone; and retest with red-team prompts before declaring the clerk assistant hardened.