Simple explanation
Having catalogued the attacks, this lesson covers the specific defensive controls used to counter them — the practical toolkit for securing an AI system.
Technical explanation
- Prompt firewall — filters malicious or manipulative input before it ever reaches the underlying model, the first line of defense against prompt injection.
- Model guardrail — a rule or filter constraining what a model is allowed to output, catching unsafe responses before they reach the user, regardless of how the input was phrased.
- Least privilege for AI agents — granting an AI agent only the specific permissions its task requires, directly countering excessive agency by limiting the blast radius of a manipulated prompt.
- Data integrity controls — safeguards (validation, checksums, access controls) protecting training or reference data from unauthorized tampering, a direct defense against data poisoning.
- Prompt templates — constraining user input into a fixed, structured format rather than accepting fully free-form text, reducing the surface area available for injection.
- Rate limiting — restricting how many requests a user or system can make to a model in a given time, limiting abuse like the extensive querying used for model theft.
- Output validation/sanitization — checking and cleaning an LLM's output before it's used downstream, the direct countermeasure to insecure output handling.
- Human-in-the-loop approval — requiring a human to review and approve an AI agent's action before it takes effect, especially for high-stakes or irreversible actions, addressing both excessive agency and overreliance simultaneously.
Defense in depth applies here just as it does in traditional security — no single control fully solves prompt injection or any other AI-specific risk; layering multiple controls (filtering input, constraining output, limiting permissions, requiring human review for high-stakes actions) is the realistic posture.
Synonyms / related terms
| Term | Means | |---|---| | Guardrail | A constraint on model output behavior | | Human-in-the-loop | Requiring human approval before a high-stakes AI action executes |
Concept Check
"A security team deploys only a prompt firewall filtering malicious input, and considers their AI application fully secured against prompt injection as a result." This is a single-layer defense, not a complete solution — even with input filtering, defense in depth (constraining output, limiting agent permissions, requiring human review for high-stakes actions) matters because a sufficiently novel or obfuscated injection attempt can still slip past input filtering alone.
Interview-style Q&A
Q: Why does least privilege matter even for an AI agent whose actions are all technically legitimate business functions? A: "Because 'legitimate function' and 'safe under manipulation' aren't the same thing. An agent with delete permissions it rarely uses is still a delete permission a manipulated prompt could invoke. Scoping an agent's actual granted access down to only what it needs for its normal task — rather than what it might theoretically ever need — shrinks the damage a successful injection or jailbreak could cause, even against an agent that's behaving 'correctly' 99% of the time."
Memory trick
"Filter In, Constrain Out, Limit Access, Review High-Stakes" — four layers of AI defense in depth, matched to the four things they each directly protect.