You cannot fully prevent prompt injection, so the practical defense is to limit what a successfully injected agent can do. Detection alone is unreliable, especially for indirect injection, where the NIST generative AI profile notes malicious instructions can ride inside otherwise trusted data. Combine input and content filtering with execution-layer controls: least-privilege roles, scoped per-action tokens, deny-by-default policy gates, and human approval on consequential writes, so an injected instruction has no standing credential and no unattended path to a system of record. Because model-side filters can be bypassed, the enforceable boundary belongs at the point of action.