/ THE SHORT ANSWER
- 01Treat external and retrieved content as untrusted input.
- 02Keep authorisation and policy enforcement outside the model.
- 03Reduce permissions, tools, secrets, actions, and blast radius.
/ dotSuper point of view
Prompt injection cannot be solved by a stronger prompt alone. Security comes from architecture that limits what a manipulated model can see, decide, and do.
What the evidence says
NIST’s Generative AI Profile describes security and information-integrity risks that require lifecycle governance, measurement, and management.
A practical decision framework
It is designed to make the decision inspectable, not to imitate a platform ranking formula, certification checklist, or legal test.
- Input boundary: classify user, retrieved, tool, and system content by trust.
- Authority boundary: enforce identity, permission, policy, and transaction limits outside the LLM.
- Output boundary: validate format, destination, action, and sensitive data before execution.
- Containment: isolate tools, log actions, rate-limit, budget, alert, pause, and recover.
| Step | Decision to record |
|---|---|
| 01 | Input boundary: classify user, retrieved, tool, and system content by trust. |
| 02 | Authority boundary: enforce identity, permission, policy, and transaction limits outside the LLM. |
| 03 | Output boundary: validate format, destination, action, and sensitive data before execution. |
| 04 | Containment: isolate tools, log actions, rate-limit, budget, alert, pause, and recover. |
How to put it into practice
Test direct, indirect, encoded, multilingual, persistent, and cross-document injection attempts.
Begin with read-only tools and synthetic data.
Add write actions one at a time behind explicit policy checks and user confirmation, then monitor both attempted and successful actions.
- Name the accountable owner and the decision this work must enable.
- Record the current evidence, assumptions, exclusions, and next review trigger.
- Measure a useful outcome rather than treating publication or deployment as success.
What this page cannot conclude
- 01No control set eliminates prompt injection or all model manipulation risk.
- 02Security design requires system-specific review, testing, and incident planning.
- 03Publication, technical eligibility, or good practice cannot guarantee ranking, referral traffic, citation, adoption, or a business outcome.
Sources
- 01OWASP Top 10 for LLM Applications 2025OWASP GenAI Security Project · accessed Aug 30, 2026
- 02Artificial Intelligence Risk Management Framework: Generative Artificial Intelligence ProfileNational Institute of Standards and Technology · accessed Aug 30, 2026
- 03AI Risk Management FrameworkNational Institute of Standards and Technology · accessed Aug 30, 2026
Our editorial standard · Found an error? Send a correction with its source.
/ CITE OR SHARE THIS GUIDE
Make the evidence easy to verify.
When you reference this guide, link to its canonical URL. That gives readers one stable place for the evidence, limitations and future updates.
dotSuper Research Desk. (August 30, 2026). Prompt Injection Controls for RAG and AI Agents: Design for Compromise. dotSuper. https://dotsuper.net/feeds/applied-systems/prompt-injection-controls-for-rag-and-agents