You are implementing a multi-agent claims-processing workflow in Microsoft Foundry. Subagents receive instructions assembled from shared system prompts plus per-task user context. Security review finds that a malicious user message can override the underwriting agent's refusal rules by injecting "ignore previous instructions." What should you implement first in the prompt design?

The correct approach is defensive system-prompt guidelines that separate immutable policy blocks from untrusted user content, with explicit non-override rules and role boundaries for each agent. Advanced prompt engineering for multi-agent systems includes defensive guidelines and prompt lifecycle management. Policy, persona, tool boundaries, and refusal rules belong in privileged prompt sections that are not treated as mutable by later user content. Each agent should have explicit non-override language and scoped behavioral guidelines so a claims user cannot reassign the underwriter as a general assistant.

Increasing the temperature of the underwriting agent so refusals become more creative is wrong because temperature affects sampling randomness, not instruction hierarchy or injection resistance.

Storing every user message only in long-term semantic memory and never in the prompt is wrong because long-term memory is a storage concern; the attack surface is how untrusted text is composed into the active context window for tool-capable agents.

Replacing all agents with a single model deployment that has no tools is wrong because removing tools and agents is an architecture rollback, not a prompt-hardening control, and does not address defensive multi-agent prompting skills measured on AI-500.

Exam focus: immutable policy blocks plus clear separation of trusted versus untrusted content in multi-agent prompts.