Prompt injection: how do I protect an LLM feature that reads user content?

Treat all user-provided content (tickets, emails, web pages, documents) as untrusted input that can contain instructions. There's no perfect prompt-level fix, so design defensively:

1. Least privilege for tools: the summarizer should not be able to close *all* tickets. Scope every tool to the current ticket id, which your code sets, never the model. 2. Human confirmation for side effects: tag suggestions are fine automatically; closing or refunding requires a human click. 3. Separate data from instructions: put untrusted content in clearly delimited blocks, and tell the model that text inside them is data to analyze, never instructions to follow. 4. Validate tool calls in code: allowed actions, argument ranges, rate limits, and an authorization check on every call. 5. Split pipelines: a model that reads untrusted content without tool access produces a structured summary, and a second step with tools only sees that structured output. 6. Log and red-team: keep a suite of injection test cases and run it on every prompt or model change.