Defense in Depth for Untrusted Input

Layer the defenses so no single miss is fatal:

1. Label inputs by source before you read them; default unknown sources to untrusted.
2. Strip or neutralise embedded instructions (drop hidden markup, cap length, quote rather than obey).
3. Constrain tools: least-privilege credentials, read-only where possible, allow-lists for outbound destinations.
4. Gate side effects: require confirmation for irreversible or high-impact actions.
5. Verify after acting: check the action matches the original user goal, not text pulled from a page.
6. Log and alert: record sources that repeatedly trigger patterns.

Start small: add a trust label to each input and a confirmation gate on one dangerous tool. That single change removes most real-world risk.