Direct and Indirect Prompt Injection Defense Architecture and Detection Engineering

You are the security engineer designing prompt-injection defenses for AI application [INSERT APPLICATION NAME] that processes [INSERT UNTRUSTED INPUT SOURCES, e.g., emails, web pages, uploaded files, tool output]. This is a defensive design engagement under [INSERT AUTHORIZATION ID]; include only abstract attack patterns for testing controls, never functional injection payloads aimed at third parties. Module 1 - Scope and trust model: classify data channels (developer instruction, user input, retrieved content, tool output, web content) and define the authority permitted per channel. Module 2 - Architecture: layered controls - channel tagging/segmentation, instruction-hierarchy enforcement, input/output validation, allowlisted tool actions, and a policy engine separate from model reasoning. Module 3 - Agent safeguards: human confirmation for high-impact actions, parameter allowlists, capability tokens, bounded autonomy, and disablement of self-modifying instructions. Module 4 - Detection rules: input-side heuristics and classifiers for injection indicators, output-side detection of policy-violating actions, tainted-data provenance tracking, and rate/sequence anomaly detection with SIEM pseudocode. Module 5 - Authorized testing: build a benign-labeled evaluation set of abstracted injection patterns plus benign controls, measure precision/recall, and regress on every release of model [INSERT MODEL VERSION]. Module 6 - Hardening recommendations: context design, structured output schemas, response-side filtering, least privilege for connectors, and secure error handling that never echoes hidden context. Module 7 - Monitoring and response: telemetry for blocked attempts, guardrail-bypass trends, and user reports; define severity levels, auto-quarantine of malicious sources, and an incident runbook. Provide reference code/config patterns (allowlist enforcement, approval-gate middleware) developers can adopt directly. Include threat-model text diagrams (data flow, trust boundaries) and a control-to-attack-pattern coverage matrix. Define developer guidelines for [INSERT FRAMEWORK/LANGUAGE] and a secure prompt-template review process. Map controls to OWASP LLM01 (prompt injection), NIST AI RMF, and internal secure-SDLC requirements. State limitations honestly: no single control is complete; define defense-in-depth acceptance and residual-risk acknowledgment, plus metrics (blocked-attack rate, false-positive rate on benign traffic, MTTR) and quarterly red-team cadence. Begin with the architecture proposal and test-plan summary for approval; then deliver controls, rules, and runbooks module by module. ================