Prompt Injection Defense Spec

Harden this LLM application prompt against prompt injection. Scenario: {{app: e.g. email summarizer that reads untrusted user content}}. 1) Rewrite the system prompt with: explicit trust boundary (system/developer content vs untrusted data channels), untrusted input wrapped in clear delimiters with a statement that it is DATA, never instructions; instructions that tool calls/actions require confirmation and can never be triggered from data content; a refusal/fallback behavior for instruction-bearing data; PII handling rules. 2) Add input preprocessing rules (strip role-like tokens, detect injection patterns, length caps) and output validation. 3) List residual risks not solvable by prompting alone (indirect injection via retrieved docs, multistep smuggling, tool abuse) and the architecture-level controls needed (allowlisting, human approval, least privilege tools). 4) Build 15 attack strings to regression-test it. Original prompt: {{...}}