Pattern

Prompt-injection containment design patterns (lethal trifecta, Dual LLM, Plan-Then-Execute, CaMeL)

Structure an agent so that untrusted content it reads (documents, web pages, email, tool outputs) cannot choose or change the consequential actions it takes, by separating the component that plans and holds tools from the component that reads untrusted text, or by fixing the plan before untrusted text arrives.

Classification Architectural constraints that stop untrusted input from triggering consequential agent actions.