Five architectural defenses against prompt injection attacks in LLM applications, layering untrusted input labeling, instruction hierarchy, tool restriction, user approval, and dual-model separation.

OWASP ranks prompt injection as the #1 threat to LLM applications. The article describes five composable defenses: wrapping untrusted text in explicit tags (e.g., <Untrusted> delimiters) or Base64 encoding; assigning explicit trust ranks to instructions so developer prompts override third-party content; restricting tool access to only what an agent needs; requiring explicit user approval before sensitive actions execute; and separating planning (a reasoning layer with no tool access) from execution (a tool-calling layer that never directly consumes untrusted input).

The dual-model pattern (Planner and Executor) is described as the most architecturally robust defense. The Planner reasons over untrusted data but has no tools, producing a structured plan; the Executor has tools but only executes that plan, never directly consuming untrusted input. Google DeepMind's CaMeL framework formalized this approach and solved the AgentDojo security benchmark.

The article states no single defense is sufficient alone. Strongest implementations layer all five defenses together: labeling untrusted content, enforcing instruction hierarchy, restricting tools to minimum required capability, requiring approval for sensitive actions, and separating planning from execution when stakes justify the complexity.